feat!: drop web UI and REST API — MCP stdio only

.github/workflows/ci.yml

@@ -0,0 +1,73 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+    tags: ["v*"]
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18, 20, 22]
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Build
+        run: pnpm build
+
+      - name: Test with coverage
+        run: pnpm test -- --coverage
+
+      - name: Upload coverage
+        if: matrix.node-version == 22
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage/
+
+  publish:
+    needs: ci
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Publish to npm
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CLAUDE.md

@@ -2,7 +2,7 @@
 
 ## Project Overview
 
-npm package that generates 3D interactive maps of TypeScript codebases. Two modes: browser (3D visualization) and MCP stdio (LLM integration).
+npm package that analyzes TypeScript codebases — parses source, builds dependency graphs, computes architectural metrics, and exposes everything via MCP stdio for LLM-assisted code understanding.
 
 ## Architecture
 
@@ -12,25 +12,28 @@ src/
   parser/index.ts     <- TS Compiler API parser (files, functions, imports)
   graph/index.ts      <- graphology graph builder + circular dep detection
   analyzer/index.ts   <- Metrics engine (PageRank, betweenness, cohesion, tension, churn, complexity, blast radius, dead exports)
-  mcp/index.ts        <- MCP stdio server (7 tools)
-  server/index.ts     <- Express web server
-  server/api.ts       <- REST API routes
+  mcp/index.ts        <- MCP stdio server (15 tools, 2 prompts, 3 resources)
+  mcp/hints.ts        <- Next-step hints for MCP tool responses
+  server/graph-store.ts <- Global graph state (shared by CLI + MCP)
+  impact/index.ts     <- Symbol-level impact analysis + rename planning
+  search/index.ts     <- BM25 search engine
+  process/index.ts    <- Entry point detection + call chain tracing
+  community/index.ts  <- Louvain clustering
+  persistence/index.ts <- Graph export/import to .code-visualizer/
   cli.ts              <- CLI entry point (commander)
-public/
-  index.html          <- Client-side 3D renderer (8 views, uses 3d-force-graph from CDN)
 docs/
   architecture.md     <- Pipeline, module map, data flow, design decisions
   data-model.md       <- All TypeScript interfaces with field descriptions
   metrics.md          <- Per-file + module metrics, force analysis, complexity scoring
-  mcp-tools.md        <- 7 MCP tools: inputs, outputs, use cases, selection guide
+  mcp-tools.md        <- 15 MCP tools: inputs, outputs, use cases, selection guide
 specs/
   active/             <- Current spec
 ```
 
 ## Pipeline
 
 ```
-CLI args -> Parser (TS AST) -> Graph Builder (graphology) -> Analyzer (metrics) -> Server (Express | MCP stdio)
+CLI args -> Parser (TS AST) -> Graph Builder (graphology) -> Analyzer (metrics) -> MCP stdio
 ```
 
 ## Key Conventions
@@ -47,9 +50,9 @@ CLI args -> Parser (TS AST) -> Graph Builder (graphology) -> Analyzer (metrics)
 - **graphology** — graph data structure. Import as `import Graph from "graphology"`. Use as both constructor and type.
 - **graphology-metrics** — PageRank, betweenness. Default imports from subpaths.
 - **@modelcontextprotocol/sdk** — MCP server. Uses `McpServer` class with `server.tool()` registration.
-- **express** — web server. Routes in `server/api.ts`, static files from `public/`.
 - **typescript** — used as a library (Compiler API), not just a dev tool.
 - **zod** — MCP tool input validation.
+- **commander** — CLI argument parsing.
 
 ### Quality Gates
 
@@ -68,7 +71,7 @@ All four must pass before shipping. Run in order: lint -> typecheck -> build ->
 
 | Change Type | Bump | Example |
 |-------------|------|---------|
-| New MCP tools, new views, new metrics | minor | 1.0.1 → 1.1.0 |
+| New MCP tools, new metrics | minor | 1.0.1 → 1.1.0 |
 | Bug fixes, description changes, doc sync | patch | 1.1.0 → 1.1.1 |
 | Breaking: removed tool, changed tool params | major | 1.1.0 → 2.0.0 |
 
@@ -117,23 +120,13 @@ pnpm publish:npm
 
 ## Security Rules
 
-### Client-side (public/index.html)
-- **NEVER use innerHTML with dynamic data** — use DOM API (`createElement` + `textContent`)
-- **NEVER use inline onclick attributes** — use `addEventListener`
-- All node data from the API must be treated as untrusted (file paths can contain HTML metacharacters)
-- Use the `el()` helper for safe DOM construction
-
-### Server-side
-- Validate and clamp all query parameters (especially `limit`)
-- API routes should return JSON 404s, not HTML
+- Validate and clamp all MCP tool input parameters
 - No filesystem access beyond the parsed graph data
 
 ## File Conventions
 
 - New analysis metrics go in `src/analyzer/index.ts`
 - New MCP tools go in `src/mcp/index.ts` (register with `server.tool()`)
-- New REST endpoints go in `src/server/api.ts`
-- New browser views go in `public/index.html` (add render function + view tab)
 - Types always in `src/types/index.ts`
 
 ## Common Pitfalls
@@ -153,12 +146,12 @@ LLM knowledge base for building this tool. Single source of truth per topic:
 | `docs/architecture.md` | Pipeline, module map, data flow, design decisions | New module or pipeline change |
 | `docs/data-model.md` | All TypeScript interfaces (mirrors `src/types/index.ts`) | Type changes |
 | `docs/metrics.md` | Per-file + module metrics, force analysis, complexity scoring | New metric added |
-| `docs/mcp-tools.md` | 7 MCP tools with inputs/outputs/use cases | New tool or param change |
+| `docs/mcp-tools.md` | 15 MCP tools with inputs/outputs/use cases | New tool or param change |
 
 ## Testing (BLOCKING)
 
 - Test runner: vitest
-- Test files: `src/**/*.test.ts`
+- Test files: `src/**/*.test.ts`, `tests/**/*.test.ts`
 - Run: `npm test` or `npx vitest run`
 
 ### Coverage Policy (ENFORCE)
@@ -171,7 +164,6 @@ LLM knowledge base for building this tool. Single source of truth per topic:
 ### Real Environment Tests (MANDATORY)
 
 - **NEVER mock internal modules** — use real parser, real graph, real analyzer
-- **NEVER mock Express** — use `supertest` against the real app
 - **NEVER mock graphology** — build real graphs with real data
 - **NEVER mock filesystem for parser tests** — use real fixture directories with real `.ts` files
 - **Only mock external third-party APIs** that require network/auth (none currently)
@@ -184,23 +176,12 @@ LLM knowledge base for building this tool. Single source of truth per topic:
 | Parser | Real `.ts` fixture files on disk, assert parsed output |
 | Graph | Real parsed files -> real graph builder, assert nodes/edges |
 | Analyzer | Real graph -> real metrics, assert values |
-| API | `supertest` against real Express app with real graph data |
 | MCP | Real MCP server instance, assert tool responses |
 | CLI | Real process execution where feasible |
 
-### Visual Verification (MANDATORY for UI changes)
-
-- After ANY UI change (HTML/CSS/client JS), start the server and verify in a browser
-- Start server: `node dist/cli.js ./src --port 3333`
-- Verify: page loads, graph renders, changed feature works visually
-- Check browser console for JavaScript errors
-- Kill server after verification
-- If browser agent is available, use it for automated visual verification
-
 ### Anti-Patterns (NEVER)
 
 - NEVER use `jest.mock()` or `vi.mock()` for internal modules
 - NEVER create fake/stub graph objects — build them through the real pipeline
-- NEVER skip tests because "it's just UI" or "it's just config"
+- NEVER skip tests because "it's just config"
 - NEVER write tests that pass regardless of implementation (test behavior, not existence)
-- NEVER ship UI changes without visual verification in a real browser