GraphFlow Token-First Surgical Engine (v3.7.0)

Token-First Surgical Code Engine for AI Coding Agents across TypeScript/JS, Python, Go, Rust, C/C++, and C# — true AST for all six language families (@babel/parser for TS/JS, optional tree-sitter grammars for the other five with structural fallback), plus a self-written semantic index for confidence-gated call-target resolution and BM25/IDF-capped, confidence-labelled doc↔code links. Six-language parity is regression-tested (51-case matrix — Rust trait dispatch and C# record handling closed), bilingual retrieval scores 1.000 EN / 1.000 ZH on isolated + packed corpora, and local task reflection replays recorded shell instructions with no LLM/network calls (explicit record or external-log auto-harvest):

• gf_read: symbol skeleton folding (27,926 → 7,840 tokens, 71.9% smaller on ast-engine.ts; 68–86% across repo files), exact symbol slicing (95.8% smaller, ~96%), automatic Cross-File Type Closure, and receiver-type-aware [Blast Radius] call-site micro-snippets — call targets are resolved by the self-written semantic index first (confidence ≥0.75), then inheritance/super heuristics (last assignment wins, generic/array/nullable annotations unwrapped; a static heuristic, not flow-sensitive). Bilingual search is validated at 1.000 EN/ZH recall@1/@3/@5.
• gf_edit: Bottom-up batch atomic edits, zero-LLM cross-repo symbol rename (renameTo) that first asks the semantic index for a resolved target (confidence ≥0.75) and then uses receiver-aware, language-family-scoped matching (foreign-receiver-only files skipped, mixed files REJECTED [ambiguous-symbol], unresolved callers roll back), plus syntax guards (true-AST rollback for TS/JS and tree-sitter ERROR/MISSING elsewhere, structural fallback), caller-arity, and struct-field deletion guards.
• gf_exec: 2-hop reverse import Diff-to-Test router with tsconfig.json/jsconfig.json alias resolution (extends chains, nearest nested configs, project references), dynamic import()/require() support and broad test-file conventions, plus a terminal output dehydrator (99.5% fewer test log tokens, up to 5 lines of failure source context) and 3-strike edit-test loop circuit breaker.
• gf_macro: Zero-cold-start Git co-change miner (mine-git), trajectory auto-compiler (.graphflow/macros/*.mjs & isomorphic auto-codemods), local task reflection (task-list / task-run / task-record / task-harvest — record a repeated shell workflow twice, or log it with task log and task harvest, then replay it offline), and a real best-effort knowledge graph (graphflow graph: type-aware calls with receiver-matched targets and foreign receivers dropped, alias-resolved imports, plus defines / co-edit — and doc-links-code edges scored by self-written BM25/IDF + PMI with per-section/per-symbol caps (≤3), global GRAPHFLOW_DOC_LINKS_MAX (default 400) and confidence labels; heuristics, not type-checked, 5000-edge cap).

This extension only launches the engine and the installer — the engine itself lives in the @roarpeng/graphflow npm package. Runtime deps are @babel/parser, @modelcontextprotocol/sdk and tree-sitter; the six tree-sitter grammar packages are optional (peer-range install warnings are expected, and a missing grammar falls back to the structural analyzer for that language — set GRAPHFLOW_TREE_SITTER=0 to force structural for all). Call-target resolution is backed by the self-written semantic index (no extra runtime deps); the optional TypeScript compiler API and LSP providers activate only when present in your environment. Check parser backends with graphflow doctor parsers, verify the true-AST/structural matrix with npm run verify:parsers, and run npm run preflight for static release checks; the suite is 26 test files and CI (6 jobs) + the parser matrix (7 jobs) are green across ubuntu/windows/macos × Node 20/22. Local task reflection (graphflow task / graphflow reflect, or gf_macro task-list/run/record/task-harvest) replays recorded shell instructions offline with no LLM/network call; auto-harvest reads .graphflow/instruction-log.jsonl written by an external writer (task log), since there is no host hook/daemon. Install merges GraphFlow's PreToolUse/PostToolUse hooks into existing host hook configs (user hooks preserved; idempotent reinstall), graphflow status shows per-agent registration state ([MCP ✓] [Skill ✓] [Rule -] [Hook ✓]), and the MCP stdio path is covered by an end-to-end test (npm test). For DeepSeek Harness (DSH), the install command writes the Cordis patch at ~/.dsh/cordis.patch.yml (an @deepseek-ai/dsh-mcp-client insert with cwd = workspace and GRAPHFLOW_WORKSPACE_ROOT) plus the skill at ~/.dsh/skills/graphflow/SKILL.md; alternatively install the configuration-only @roarpeng/graphflow-dsh bundle via plugin_manager install_bundle — use one path or the other, not both. DSH does not read ~/.dsh/mcp.json.

Commands

• GraphFlow: Install MCP, Skills & Hooks to Agents (graphflow.installMcp)
• GraphFlow: Mine Git Co-Change History (graphflow.mineGit)
• GraphFlow: Show Detected Agents Status (graphflow.status)