chore(deps-dev): bump vitest from 3.2.4 to 3.2.6

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,77 @@
+name: Bug report
+description: Report a reproducible problem in CodeGraph
+title: "[Bug]: "
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a problem. For security issues, use private vulnerability reporting instead of this form.
+  - type: input
+    id: version
+    attributes:
+      label: CodeGraph version or commit
+      description: Provide the npm version or full Git commit SHA.
+      placeholder: 0.1.0 or 0123456789abcdef...
+    validations:
+      required: true
+  - type: input
+    id: node
+    attributes:
+      label: Node.js version
+      placeholder: 22.14.0
+    validations:
+      required: true
+  - type: input
+    id: platform
+    attributes:
+      label: Platform
+      description: Include the operating system and CPU architecture.
+      placeholder: macOS 15 arm64
+    validations:
+      required: true
+  - type: dropdown
+    id: install
+    attributes:
+      label: Install method
+      options:
+        - npx or npm package
+        - Source checkout
+        - MCPB desktop extension
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Give the smallest complete sequence that reproduces the problem.
+      placeholder: Numbered commands and configuration, with secrets removed.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Redacted logs
+      description: Remove tokens, credentials, private source code, personal data, and local usernames.
+      render: shell
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Sensitive information
+      options:
+        - label: I removed credentials, private source code, personal data, and other sensitive information.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Phoenixrr2113/codebase-graph/security/advisories/new
+    about: Report vulnerabilities privately. Do not include exploit details in a public issue.
+  - name: Questions and ideas
+    url: https://github.com/Phoenixrr2113/codebase-graph/discussions
+    about: Ask for help or discuss ideas that are not yet actionable issues.

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Propose an outcome that would improve CodeGraph
+title: "[Feature]: "
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user or developer problem needs to be solved?
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Proposed outcome
+      description: Describe the observable result, not only an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What workarounds or different approaches have you tried?
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope
+      description: Which package, interface, or workflow would this affect? Include compatibility or migration concerns.
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/pull_request_template.md

@@ -0,0 +1,23 @@
+## What changed
+
+Describe the problem and the smallest complete change that solves it.
+
+## Related issue
+
+Closes #
+
+## Security impact
+
+Describe affected inputs, access paths, dependencies, secrets, and data. Write "None" only after checking them.
+
+## Verification
+
+List the exact commands you ran and their results.
+
+## Checklist
+
+- [ ] Tests cover new behavior and regressions.
+- [ ] `pnpm lint`, `pnpm typecheck`, `pnpm test`, and `pnpm build` pass.
+- [ ] User-facing documentation is updated, or no documentation change is needed.
+- [ ] Release impact is documented, or this change does not affect published artifacts.
+- [ ] No secrets, generated `dist` trees, or local `.codegraph` data are included.

.github/workflows/ci.yml

@@ -14,91 +14,148 @@ concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  CODEGRAPH_EMBEDDING_PROVIDER: none
+
 jobs:
-  # Hard gate: must be green for a PR to merge.
-  # Builds every package (tsc, so this also typechecks the whole monorepo)
-  # and runs @codegraph/core's suite, which is green without any API keys
-  # or services.
-  build-and-test:
-    name: Build & unit tests
+  repository:
+    name: Repository
     runs-on: ubuntu-latest
-    env:
-      # Documented offline/CI mode (see README): skip vector indexes so no
-      # embedding API key is required.
-      CODEGRAPH_EMBEDDING_PROVIDER: none
     steps:
-      - uses: actions/checkout@v4
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4 # version comes from package.json "packageManager"
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build & typecheck library packages
-        # Excludes @codegraph/mcp (release-only esbuild + native-module
-        # packaging via packages/npm-package/build.mjs — not a correctness
-        # check, and needs a populated tree) and codegraph-landing (the
-        # marketing app, already gated by Vercel). Everything else is tsc.
-        run: pnpm turbo build --filter='!@codegraph/mcp' --filter='!codegraph-landing'
-
-      - name: Unit tests (core)
-        run: pnpm turbo test --filter=@codegraph/core
-
-  # Non-blocking smoke run against a live FalkorDB. Surfaces graph/plugin-nlp
-  # status without gating merges, because the suite still has pre-existing
-  # failures that need triage (integration tests that require an embedding
-  # provider + LLM/Voyage credentials, a few legacy tests referencing removed
-  # APIs, and packages lacking --passWithNoTests). Once those are resolved,
-  # drop `continue-on-error` and fold these filters into build-and-test.
-  integration-smoke:
-    name: Integration smoke (FalkorDB, non-blocking)
+      - name: Audit production dependencies
+        run: pnpm audit:prod
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build
+
+      - name: Build desktop extension
+        run: pnpm build:mcpb
+
+  integration:
+    name: Integration (FalkorDB)
     runs-on: ubuntu-latest
-    continue-on-error: true
     env:
-      CODEGRAPH_EMBEDDING_PROVIDER: none
       FALKORDB_HOST: localhost
+      FALKORDB_PORT: 16379
     services:
       falkordb:
-        image: falkordb/falkordb:latest
+        image: falkordb/falkordb@sha256:52b6583afe7b5ba6bbf5b5f0290bdaa765bd97477b310a590771dc33ebc7b5f5
         ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
-      cgbench-falkordb:
-        image: falkordb/falkordb:latest
-        ports:
-          - 6380:6379
+          - 16379:6379
         options: >-
           --health-cmd "redis-cli ping"
           --health-interval 10s
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: pnpm
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Graph + NLP tests (informational)
-        # turbo builds the needed deps automatically (test depends on build);
-        # this never triggers the @codegraph/mcp packaging build.
-        run: pnpm turbo test --filter=@codegraph/graph --filter=@codegraph/plugin-nlp
+      - name: Build packages
+        run: pnpm build
+
+      - name: Run service-backed integration tests
+        run: pnpm test:integration
+
+      - name: Test repository scripts
+        run: pnpm test:scripts
+
+  package-build:
+    name: Build package artifact
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build npm package
+        run: pnpm build:npm
+
+      - name: Validate npm package
+        run: pnpm validate:npm
+
+      - name: Upload exact package artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: codegraph-mcp-package
+          path: tmp/release
+          if-no-files-found: error
+          retention-days: 3
+
+  package:
+    name: Package (${{ matrix.os }})
+    needs: package-build
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          package-manager-cache: false
+
+      - name: Download exact package artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: codegraph-mcp-package
+          path: tmp/release
+
+      - name: Install macOS embedded runtime libraries
+        if: runner.os == 'macOS'
+        run: brew install libomp openssl@3
+
+      - name: Test package in a fresh consumer
+        run: node scripts/release/smoke-package.mjs tmp/release/package-result.json