
Security News
RubyGems Adds Cooldown Feature to Bundler for Newly Published Gems
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.
code-graph-llm
Advanced tools
Inspired by Andrej Karpathy skills, juliusbrussee/caveman, and the community's work building better agent workflows.
A language-agnostic, ultra-compact codebase mapper and agent memory system for LLM agents. Code-Graph gives agents a compact file, symbol, and dependency index, then pairs it with persistent project learnings so agents can avoid repeating mistakes across sessions.
process.argv[1] resolves to the junction path while import.meta.url resolves the real path; path.resolve doesn't dereference junctions so main() was never called. Fixed with realpathSync on both sides.code-graph-llm from its own dependencies. npm resolved the self-reference from the registry (stale 4.11.0) instead of local source, making global installs permanently stale.See RELEASE_NOTES.md for full history.
# Global installation (recommended for CLI usage)
npm install -g code-graph-llm
# Project-level installation
npm install --save-dev code-graph-llm
# 0. Check version and help
code-graph --version
code-graph --help
# 1. Initialize rules and memory
code-graph init
# 2. Build the graph
code-graph generate
# 3. Install all bundled skills for one agent
code-graph install-skills claude
# 4. Or install globally for all projects
code-graph install-skills -g claude
Every install prints each target it writes:
[Code-Graph v4.12.1] Installed/updated: /absolute/path/to/AGENTS.md
[Code-Graph v4.12.1] Installed/updated: /absolute/path/to/.codex/hooks.json
Code-Graph operates in two modes: Passive Skills and Active Agents.
| Mode | Paradigm | Benefit | Command |
|---|---|---|---|
| Unified | Both | Installs skills and the active agent together. | code-graph install <platform> |
| Skills | Passive Context | Injects the graph and memory rules into the agent's normal workflow. | code-graph install-skills <platform> |
| Agents | Active Delegation | Registers code-graph as a specialized sub-agent. | code-graph install-agent <platform> |
Get the full Code-Graph experience by installing both skills and the active sub-agent in one command.
code-graph install gemini
Uninstall with:
code-graph uninstall <platform>
Skills are always-on configurations that tell your agent how to use the project map and memory files. code-graph install-skills <platform> installs all bundled skills by default for every supported platform.
llm-code-graph.md, the canonical file, symbol, and dependency index, before raw file searches.llm-agent-project-learnings.md so agents retain project-specific lessons.# Install all bundled skills
code-graph install-skills gemini
# Install one skill
code-graph install-skills cursor projectmap
# Install only dependency freshness rules
code-graph install-skills codex freshdeps
# Install surgical diff rules (CLI alias remains changelimit-compatible)
code-graph install-skills claude surgicalchanges
# Uninstall one skill
code-graph uninstall-skills claude reflections
# Uninstall all skills for a platform
code-graph uninstall-skills claude
Agents are specialized personas. Instead of only reading project files, a main orchestrator such as Gemini CLI or Claude Code can delegate mapping and analysis work to the Code-Graph agent.
# Register code-graph as a sub-agent
code-graph install-agent claude
# Example delegation:
# "Hey code-graph, analyze the dependency chain of the auth module."
Uninstall with:
code-graph uninstall-agent <platform>
Claude Code receives focused sub-agents when available:
code-graph: General project-map and reflection specialist.code-graph-locator: Finds the smallest relevant file and symbol set before raw source reads.code-graph-tracer: Traces dependency and inheritance paths from ## EDGES.code-graph-reviewer: Checks map freshness, reflection coverage, scope creep, and dependency freshness.Use -g before the platform to install skills globally. Without -g, skills are installed for the current project when the platform supports project-level instructions.
| Agent | Command | Install Target |
|---|---|---|
| AdaL | code-graph install-skills adal | ~/.adal/skills/ |
| AiderDesk | code-graph install-skills aider-desk | ~/.aider-desk/skills/ |
| Aider | code-graph install-skills aider | ~/.aider/skills/ |
| Amp | code-graph install-skills amp | ~/.config/agents/skills/ |
| Antigravity | code-graph install-skills antigravity | ~/.gemini/antigravity/skills/ |
| Augment | code-graph install-skills augment | ~/.augment/skills/ |
| Claude Code | code-graph install-skills claude | ~/.claude/skills/ |
| Cline / Warp | code-graph install-skills cline or code-graph install-skills warp | ~/.agents/skills/ |
| Codex | code-graph install-skills codex | ~/.codex/skills/ |
| CodeArts Agent | code-graph install-skills codearts-agent | ~/.codeartsdoer/skills/ |
| CodeBuddy | code-graph install-skills codebuddy | ~/.codebuddy/skills/ |
| Codemaker | code-graph install-skills codemaker | ~/.codemaker/skills/ |
| Code Studio | code-graph install-skills codestudio | ~/.codestudio/skills/ |
| Command Code | code-graph install-skills command-code | ~/.commandcode/skills/ |
| Continue | code-graph install-skills continue | ~/.continue/skills/ |
| Cortex Code | code-graph install-skills cortex | ~/.snowflake/cortex/skills/ |
| Crush | code-graph install-skills crush | ~/.config/crush/skills/ |
| Cursor | code-graph install-skills cursor | ~/.cursor/skills/ |
| Deep Agents | code-graph install-skills deepagents | ~/.deepagents/agent/skills/ |
| Devin for Terminal | code-graph install-skills devin | ~/.config/devin/skills/ |
| Droid | code-graph install-skills droid | ~/.factory/skills/ |
| Firebender | code-graph install-skills firebender | ~/.firebender/skills/ |
| ForgeCode | code-graph install-skills forgecode | ~/.forge/skills/ |
| Gemini CLI | code-graph install-skills gemini or code-graph install-skills gemini-cli | ~/.gemini/skills/ |
| Generic Agent | code-graph install-skills generic | ~/.generic/skills/ |
| GitHub Copilot | code-graph install-skills copilot or code-graph install-skills github-copilot | ~/.copilot/skills/ |
| Goose | code-graph install-skills goose | ~/.config/goose/skills/ |
| Hermes | code-graph install-skills hermes | ~/.hermes/skills/ |
| IBM Bob | code-graph install-skills bob | ~/.bob/skills/ |
| IntelliJ / JetBrains | code-graph install-skills intellij | AGENTS.md or ~/.intellij/skills/ with -g |
| iFlow CLI | code-graph install-skills iflow-cli | ~/.iflow/skills/ |
| Junie | code-graph install-skills junie | ~/.junie/skills/ |
| Kilo Code | code-graph install-skills kilo | ~/.kilocode/skills/ |
| Kimi Code CLI | code-graph install-skills kimi-cli | ~/.config/agents/skills/ |
| Kiro IDE/CLI | code-graph install-skills kiro or code-graph install-skills kiro-cli | ~/.kiro/skills/ |
| Kode | code-graph install-skills kode | ~/.kode/skills/ |
| MCPJam | code-graph install-skills mcpjam | ~/.mcpjam/skills/ |
| Mistral Vibe | code-graph install-skills mistral-vibe | ~/.vibe/skills/ |
| Mux | code-graph install-skills mux | ~/.mux/skills/ |
| Neovate | code-graph install-skills neovate | ~/.neovate/skills/ |
| OpenClaw | code-graph install-skills openclaw | ~/.openclaw/skills/ |
| OpenCode | code-graph install-skills opencode | ~/.config/opencode/skills/ |
| OpenHands | code-graph install-skills openhands | ~/.openhands/skills/ |
| Pi | code-graph install-skills pi | ~/.pi/agent/skills/ |
| Pochi | code-graph install-skills pochi | ~/.pochi/skills/ |
| Qoder | code-graph install-skills qoder | ~/.qoder/skills/ |
| Qwen Code | code-graph install-skills qwen-code | ~/.qwen/skills/ |
| Replit | code-graph install-skills replit | ~/.config/agents/skills/ |
| Roo Code | code-graph install-skills roocode or code-graph install-skills roo | ~/.roo/skills/ |
| Rovo Dev | code-graph install-skills rovodev | ~/.rovodev/skills/ |
| Tabnine CLI | code-graph install-skills tabnine-cli | ~/.tabnine/agent/skills/ |
| Trae | code-graph install-skills trae | ~/.trae/skills/ |
| Trae CN | code-graph install-skills trae-cn | ~/.trae-cn/skills/ |
| Universal | code-graph install-skills universal | ~/.config/agents/skills/ |
| VS Code Copilot Chat | code-graph install-skills vscode | .github/copilot-instructions.md or ~/.vscode/skills/ with -g |
| Windsurf | code-graph install-skills windsurf | ~/.codeium/windsurf/skills/ |
| Zencoder | code-graph install-skills zencoder | ~/.zencoder/skills/ |
Every supported platform receives all bundled skills when installing all skills. Platforms with native skill or rule formats get native artifacts; the rest receive the same mandatory instructions through their project instruction file, usually AGENTS.md.
| Platform | Action Taken | Directory / Files |
|---|---|---|
| Claude Code | Injects instructions and installs PreToolUse hooks for Read, Grep, and Glob; agent install creates split Code-Graph sub-agents. | CLAUDE.md, .claude/settings.json, .claude/agents/ |
| Cursor | Writes always-on .mdc rule files for each bundled skill with alwaysApply: true. | .cursor/rules/ |
| Gemini CLI | Installs global skills with YAML frontmatter and GEMINI.md memory imports. | ~/.gemini/skills/, GEMINI.md |
| Antigravity | Writes always-on skills and rules locally, plus the specialized Code-Graph agent skill globally. | .agent/skills/, .agent/rules/, ~/.gemini/antigravity/skills/code-graph/ |
| Kiro IDE/CLI | Writes steering files locally; the specialized Code-Graph agent is registered globally. | .kiro/steering/, ~/.kiro/agents/code-graph/ |
| Codex | Updates AGENTS.md and installs enabled nested PreToolUse hooks for Bash. | AGENTS.md, .codex/hooks.json |
| OpenCode | Registers per-skill plugins and preserves existing plugin entries. | AGENTS.md, .opencode/plugins/, opencode.json |
| Roo Code | Injects instructions into project rule files. | .clinerules, .roorules |
| IntelliJ / JetBrains | Adds architectural context to a discoverable file. | AGENTS.md |
| GitHub Copilot CLI | Copies skills globally for persistence. | ~/.copilot/skills/ |
| VS Code Copilot | Writes session-persistent instructions. | .github/copilot-instructions.md |
| Aider / Trae / Others | Updates project instructions and copies skills globally when supported. | AGENTS.md, ~/.<platform>/skills/ |
Instruct your agent to follow the strict protocol in llm-agent-rules.md:
llm-agent-project-learnings.md before starting any task.llm-code-graph.md before raw file searches or architecture analysis.llm-code-graph.md after structural code changes.Recommended generic prompt:
Before acting, read llm-code-graph.md and follow llm-agent-rules.md. Treat all bundled skills as mandatory. Use latest stable compatible dependencies and current APIs; avoid deprecated choices. If you encounter a bug, environment quirk, or reusable project lesson, record it with code-graph reflect <CAT> <LESSON>.
llm-code-graph.md is a compact index generated from the project. Each file entry is designed to help an agent decide which files matter before opening raw source:
* marks a core entry point or high-importance file.(↑out ↓in) shows dependency counts. Outgoing dependencies are files or packages this file references; incoming dependencies are files that reference it.d: is a short description extracted from file comments or nearby context.s: lists important symbols found in the file, such as classes, functions, types, and exported values.## EDGES section lists dependency relationships in the form [source] -> [targets].For example:
- *src/auth.js (3↑ 5↓) [TODO:Add JWT rotation] | d: Handles user authentication.
- s: [login [(username, password)], validateToken [(token: string)]]
## EDGES
[src/auth.js] -> [jwt-lib, db-connector]
[AdminUser] -> [BaseUser]
This means src/auth.js is a core file with 3 outgoing dependencies and 5 incoming references. It contains the login and validateToken symbols, has a TODO about JWT rotation, depends on jwt-lib and db-connector, and includes an inheritance relationship where AdminUser extends or implements BaseUser.
Register code-graph as an active sub-agent to enable explicit delegation.
| Platform | Command | Action Taken |
|---|---|---|
| Gemini CLI | code-graph install-agent gemini | Registers global agent in ~/.gemini/agents/code-graph.md. |
| Claude Code | code-graph install-agent claude | Registers split sub-agents in .claude/agents/: code-graph, code-graph-locator, code-graph-tracer, and code-graph-reviewer. |
| Antigravity | code-graph install-agent antigravity | Registers agent skill in ~/.gemini/antigravity/skills/. |
| Kiro IDE/CLI | code-graph install-agent kiro | Registers agent in ~/.kiro/agents/. |
| Generic Agent | code-graph install-agent generic | Generates .code-graph-agent.md persona prompt. |
index.js CLI entry point and public re-exports
lib/
config.js Constants, regex patterns, shared utilities
parser.js CodeParser: symbol, edge, and tag extraction
mapper.js ProjectMapper: file walking and graph generation
reflections.js ReflectionManager: lesson persistence
initializer.js ProjectInitializer: rule and reflection scaffolding
install-log.js Shared versioned install target logging
skills.js SkillManager: platform skill installation
agents.js AgentManager: sub-agent registration
test/
index.test.js Unit tests for parser, mapper, skills, and CLI behavior
platform-audit.js Integration checks across supported platforms
.gitignore patterns.TODO, FIXME, BUG, and DEPRECATED tags from comments.llm-code-graph.md file with capped descriptions, symbols, tags, and a dedicated ## EDGES section.FAQs
Compact, language-agnostic codebase mapper for LLM token efficiency.
The npm package code-graph-llm receives a total of 131 weekly downloads. As such, code-graph-llm popularity was classified as not popular.
We found that code-graph-llm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.