## [0.1.0] - 2026-02-18

### 🚀 Features

- Clewso v0.1.0
- Enhance codebase search with contextual traversal, add module exploration tool, and implement platform/engine mode API configuration.
- *(mcp)* Add verify_concept tool for hallucination prevention
- *(mcp)* Add Mermaid diagram generation to explore_module
- *(examples)* Add Clew-Bot CLI Reference Implementation
- *(api)* Add path filter support to Qdrant adapter
- *(github)* Add PR analysis workflow with Mermaid graphs
- *(cli)* Add packaged CLI with improved terminal UX
- *(release)* Add installation script and CI/CD
- Implement risk analysis for added code lines using regex patterns, enhance CLI output with a progress bar, and display identified risk factors.
- Implement API tests for search, graph traversal, and health endpoints, introducing shared test fixtures.
- Add a comprehensive tech debt register document
- Add `AGENTS.md` to establish core development guidelines and coding standards for the project.
- Initialize clew-ingestion dependencies, update Qdrant adapter and related tests, and modify docker-compose configuration.

### 🐛 Bug Fixes

- *(examples)* Follow HTTP 307 redirects in clew-bot
- *(examples)* Handle list response from search endpoint
- *(examples)* Use correct /graph/traverse endpoint
- *(examples)* Use correct start_node_id field in traverse payload
- *(examples)* Improve clew_bot output - readable labels, proper names, attribution header
- Lint issues
- *(docs)* Update documentation to match implementation and fix mcp server
- *(ci)* Fix linter errors and update docker compose command
- Align start_node_id with start_id matching Platform
- Revert start_id to start_node_id and clean up comments
- Add missing `httpx` and `asyncpg` dependencies, correct `verify_concept` docstring typo, and hoist `random` import in `search.py`.
- Implement variable-depth Neo4j traversal (QUAL-2)
- Tech debt cleanup

### 💼 Other

- First commit
- 🔒 Fix hardcoded dummy API key in embeddings adapter (#3)

* Fix security vulnerability: remove hardcoded dummy API key

- Removed hardcoded "test" API key in `_check_openai` function in `packages/clew-api/src/adapters/embeddings.py`
- Relied on `OpenAIEmbeddings` default behavior to check for `OPENAI_API_KEY` environment variable
- Verified that `OpenAIEmbeddings` can be instantiated without arguments
- Verified that tests pass with no regressions

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Fix hardcoded API key and linting issues

- Removed hardcoded "test" API key in `packages/clew-api/src/adapters/embeddings.py`
- Fixed linting errors (unused imports, unsorted imports, line length) in `packages/clew-api/tests`
- Relied on `OpenAIEmbeddings` default behavior to check for `OPENAI_API_KEY` environment variable
- Verified that `OpenAIEmbeddings` can be instantiated without arguments
- Verified that tests pass with no regressions

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🔒 Fix Hardcoded Default Password in Neo4j Adapter (#5)

* Fix: remove hardcoded Neo4j password default and enforce config

- Removed default arguments (uri, user, password) from Neo4jStore.__init__ in packages/clew-api/src/adapters/neo4j.py to prevent insecure defaults.
- Updated _check_protocol helper to use explicit dummy arguments.
- Removed default value for NEO4J_PASSWORD in packages/clew-api/src/config.py to enforce setting the password via environment variables.

This change mitigates a security vulnerability where the application could default to a known weak password. Configuration is now mandatory.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Fix: remove hardcoded Neo4j password default and enforce config

- Removed default arguments (uri, user, password) from Neo4jStore.__init__ in packages/clew-api/src/adapters/neo4j.py to prevent insecure defaults.
- Updated _check_protocol helper to use explicit dummy arguments.
- Removed default value for NEO4J_PASSWORD in packages/clew-api/src/config.py to enforce setting the password via environment variables.
- Fixed linting issues (import sorting, line length) in packages/clew-api/tests/conftest.py, packages/clew-api/tests/test_graph.py, and packages/clew-api/tests/test_search.py to pass CI.

This change mitigates a security vulnerability where the application could default to a known weak password. Configuration is now mandatory.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧹 Bound search limit to prevent resource exhaustion (#8)

* fix(api): bound search limit to prevent resource exhaustion

- Add Pydantic `Field` validation to `SearchRequest.limit` (1 <= limit <= 100).
- Add tests for limit validation in `packages/clew-api/tests/test_search_limits.py`.
- Add `pytest` and `pytest-asyncio` to dev dependencies in `packages/clew-api/pyproject.toml` to support testing.

This change prevents potential Denial of Service (DoS) attacks by restricting the number of search results that can be requested in a single query.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* fix(tests): resolve linting errors in api tests

- Sort imports and remove unused imports in `conftest.py`, `test_graph.py`, `test_search.py`, `test_search_limits.py`.
- Fix long line in `conftest.py`.
- Verify with `ruff check`.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Make client timeout configurable via environment variable (#4)

* feat: make client timeout configurable via environment variable

Refactor `get_client_config` in `packages/clew-mcp/src/server.py` to read `CLEW_API_TIMEOUT` from environment variables, defaulting to `30.0`. This improves code health by avoiding hardcoded values.

Added `packages/clew-mcp/tests/test_config.py` to verify the new behavior.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* fix: resolve ruff linting errors in tests

Fix linting errors in `packages/clew-mcp/tests/test_config.py` (import sorting) and various files in `packages/clew-api/tests/` (import sorting, unused imports, line length) to ensure CI passes.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Async Qdrant Client Optimization (#6)

* perf(clew-api): use AsyncQdrantClient for non-blocking search

This change replaces the synchronous `QdrantClient` with `AsyncQdrantClient` in `QdrantStore`.
The `search` method now awaits the `query_points` call, preventing blocking of the event loop during vector searches.

This resolves the issue where search operations would stall the API under load.
No functionality changes were made to the search logic itself.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* fix(lint): resolve ruff linting errors in tests

- Sort imports in `packages/clew-api/tests/conftest.py`, `test_graph.py`, and `test_search.py`.
- Remove unused imports in tests.
- Fix line length violation in `conftest.py`.

This fixes the CI lint job failure.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- ⚡ Performance Optimization: Batch Qdrant Upserts (#9)

* feat(ingestion): batch qdrant upserts to optimize performance

Replaces single-item upserts with batched upserts in the ingestion pipeline.
This reduces network overhead significantly.
- Implemented `VectorStore.add` and `VectorStore.flush` methods.
- Configured auto-flush at 100 items.
- Updated `ingest.py` to use `add` and `flush`.
- Added unit tests for batching logic.
- Benchmark showed improvement from ~1.56s to ~0.03s in synthetic test.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* feat(ingestion): batch qdrant upserts to optimize performance

Replaces single-item upserts with batched upserts in the ingestion pipeline.
This reduces network overhead significantly.
- Implemented `VectorStore.add` and `VectorStore.flush` methods.
- Configured auto-flush at 100 items.
- Updated `ingest.py` to use `add` and `flush`.
- Added unit tests for batching logic.
- Fixed lint errors in `clew-api` and `clew-ingestion` (import sorting, unused imports, line length).
- Benchmark showed improvement from ~1.56s to ~0.03s in synthetic test.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧹 Fix bare exception handling and blocking I/O in Ollama embeddings (#7)

* Refactor OllamaEmbeddings.embed to use async httpx and specific exception handling

- Replaced synchronous `httpx.post` with `httpx.AsyncClient` to fix blocking I/O in async context.
- Replaced bare `except Exception` with specific `httpx.RequestError` and `(ValueError, KeyError)` handlers.
- Added comprehensive unit tests in `packages/clew-api/tests/test_embeddings.py`.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Refactor OllamaEmbeddings and fix linting in tests

- Refactored `OllamaEmbeddings.embed` to use `httpx.AsyncClient` for non-blocking I/O.
- Replaced bare `except Exception` with specific `httpx.RequestError` and `(ValueError, KeyError)` handling.
- Added `packages/clew-api/tests/test_embeddings.py` with comprehensive test coverage.
- Fixed linting errors (I001, E501, F401) across `clew-api` test suite.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧹 Remove unused _check_protocol function in neo4j adapter (#10)

* Remove unused _check_protocol function in neo4j adapter

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Remove unused _check_protocol function and fix linting errors

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Add test for parser initialization failure (#11)

* test: add CodeParser initialization failure test

    Added a test case for CodeParser initialization to verify that it
    gracefully handles failures when loading tree-sitter languages.

    This involved creating a new test file `packages/clew-ingestion/tests/test_parser.py`
    and mocking `tree_sitter` and `tree_sitter_languages` modules as they
    are not present in the test environment.

    The test ensures that if loading a language fails (e.g., Python), the
    parser continues to load other languages and does not crash.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* test: add CodeParser init failure test and fix linting

    Added a test case for CodeParser initialization to verify that it
    gracefully handles failures when loading tree-sitter languages.

    Fixed linting issues in `packages/clew-api` (unsorted imports, unused imports, line length)
    to pass CI checks.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧪 Add tests for verify_concept MCP tool (#12)

* Add tests for verify_concept MCP tool

- Create `packages/clew-mcp/tests/test_server.py` and `__init__.py`
- Add unit tests for `verify_concept` tool, covering:
  - Success case (concept exists)
  - Not found case
  - API error handling
  - Generic exception handling
- Mock `httpx.AsyncClient` to avoid network calls during tests.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Add tests for verify_concept MCP tool and fix linting

- Add unit tests for `verify_concept` in `packages/clew-mcp/tests/test_server.py`.
- Mock `httpx.AsyncClient` to avoid network calls.
- Fix linting errors (I001, E501, F401) in `packages/clew-api` tests to ensure CI passes.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧪 Add tests for clew-mcp client configuration (#13)

* Add tests for clew-mcp client configuration

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Fix lint errors in tests for CI compliance

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧪 Add exhaustive test suite for MCP tools (search, explore, verify)
- 🧪 Add tests for GraphStore in ingestion (#18)

* Add tests for GraphStore in clew-ingestion

Added unit tests for the GraphStore class in packages/clew-ingestion.
These tests mock the neo4j driver and verify that the correct Cypher queries
are executed for various node and relationship creation methods.
Mocking neo4j in sys.modules allows running these tests without the neo4j
dependency installed in the test environment.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Fix lint errors in clew-api/tests

Fixed import sorting, unused imports, and line length violations in
packages/clew-api/tests/ to pass CI lint checks.
These changes were required to fix a CI failure on the 'lint' job.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Merge PR #16: Add unit tests for CodeParser in clew-ingestion

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧪 Add test for vector collection creation failure (#20)

* Add unit test for VectorStore collection creation failure handling

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Add unit test for VectorStore collection creation and fix lint errors

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Add unit tests for VectorStore in clew-ingestion (#23)

* Add tests for VectorStore in ingestion

- Added `packages/clew-ingestion/tests/test_vector.py`
- Added unit tests for `VectorStore` initialization, collection management, and upsert logic.
- Mocked external dependencies (`QdrantClient`, `uuid`, `random`) to ensure isolation.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Fix lint errors in tests

- Fixed unsorted imports in `conftest.py`, `test_graph.py`, `test_search.py`, `test_vector.py`.
- Fixed line length violation in `conftest.py`.
- Fixed unused variable `store` in `test_vector.py`.
- Fixed unused imports (`random`, `GraphEdge`, `GraphNode`, `AsyncMock`, `SearchResult`).

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Add integration tests for ingestion workflow (#24)

* feat(test): Add integration tests for clew-ingestion ingest_repo

Adds a new integration test suite for `packages/clew-ingestion/src/ingest.py`.
The tests mock external dependencies (git, tree-sitter, vector store, graph store)
to verify the ingestion workflow orchestration without requiring a full environment setup.

- Created `packages/clew-ingestion/tests/test_ingest.py`
- Implemented `test_ingest_repo_integration` covering:
  - File system interaction (using `tmp_path`)
  - VectorStore upserts
  - GraphStore node/relationship creation
  - CodeParser interaction
- Mocked dependencies using `sys.modules` patching in a fixture for isolation.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* fix(test): Resolve linting errors in clew-api tests

This commit fixes linting errors detected by the CI check in `packages/clew-api`.
- Sorted imports in `conftest.py`, `test_graph.py`, and `test_search.py`.
- Removed unused imports (e.g., `GraphEdge`, `AsyncMock`).
- Fixed line length violation in `conftest.py` (E501).

These changes ensure the entire monorepo passes `ruff check` cleanly.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Refactor search endpoint to use HashEmbeddings class (#25)

- Replaces inline hash-based vector generation with HashEmbeddings class
- Removes duplicate logic and unused random import
- Verified with existing tests

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Refactor get_client_config in clew-mcp server to remove dead code and simplify logic. (#26)

- Removed redundant `if/else` block and `pass` statements.
- Unified `base_url` processing.
- Added comprehensive unit tests for `get_client_config` covering both Platform and Engine modes.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Refactor config.py to use Pydantic V2 model_config (#27)

Replaces the deprecated `class Config` in `Settings` with `model_config = SettingsConfigDict(...)`. This aligns with Pydantic V2 best practices and provides a clear migration path.

Verification:
- Created a reproduction script to verify `Settings` instantiation and configuration loading.
- Ran existing tests in `packages/clew-api/tests` and they passed.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Sort dependencies in clew-api and fix Dockerfile (#28)

Sorted dependencies in `packages/clew-api/pyproject.toml` alphabetically for better maintainability.
Added `httpx` and `asyncpg` to `packages/clew-api/Dockerfile` to prevent runtime failures in the containerized environment, as these were missing despite being required dependencies.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Refactor Neo4j adapter to catch specific exceptions and log stack traces. (#29)

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Fix unbounded query parameter in SearchRequest (#30)

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- 🧹 Refactor: Unified configuration and configurable Ollama timeout
- 🧪 Fix: Standardize mocks and absolute imports in tests
- 🧪 Fix: Finalize test mocks and integration assertions
- Add unit tests for clew-api adapters (#33)

* Add unit tests for Qdrant and Neo4j adapters in clew-api

Added unit tests for `src/adapters/qdrant.py` and `src/adapters/neo4j.py` in `packages/clew-api`.
These tests mock the underlying drivers (`AsyncQdrantClient`, `GraphDatabase.driver`) to verify adapter logic without external dependencies.
Tests cover lazy initialization, connection handling, query execution, filtering logic, and error handling.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

* Add unit tests for Qdrant and Neo4j adapters in clew-api

Added unit tests for `src/adapters/qdrant.py` and `src/adapters/neo4j.py` in `packages/clew-api`.
These tests mock the underlying drivers (`AsyncQdrantClient`, `GraphDatabase.driver`) to verify adapter logic without external dependencies.
Tests cover lazy initialization, connection handling, query execution, filtering logic, and error handling.
Fixed linting issues (imports, line length) to pass CI.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Add unit tests for Qdrant and Neo4j adapters in clew-api

Added unit tests for `src/adapters/qdrant.py` and `src/adapters/neo4j.py` in `packages/clew-api`.
These tests mock the underlying drivers (`AsyncQdrantClient`, `GraphDatabase.driver`) to verify adapter logic without external dependencies.
Tests cover lazy initialization, connection handling, query execution, filtering logic, and error handling.
Fixed linting issues (imports, line length, whitespace) in multiple test files to pass CI.

Co-authored-by: matchdav <865372+matchdav@users.noreply.github.com>
- Merge branch 'unit-tests-clew-api-adapters-4051418959524951319'

### 🚜 Refactor

- Address QUAL-3 (extract MCP server helpers)
- Address ERR-1 and CONF-1 technical debt
- Improve code readability by reformatting long lines and removing unnecessary f-strings.
- Migrate MCP server tests to use respx for HTTP request mocking

### 📚 Documentation

- Add CONTRIBUTING.md
- Add MIT LICENSE
- Expand example.env with all config options
- Add ADRs for MCP Strategy and System Backstop
- Archive universal MCP strategy ADR
- *(adr)* Add ADR-004 for Stream 3 completion
- *(adr)* Add ADR-005 GitHub Integration
- Update README with current features
- Add installation options to README
- Add release checklist with CI/CD credentials guide
- Archive MCP Strategy design document
- Archive Alpha Readiness Review and update Roadmap with pre-release priorities
- Archive Integration Test Plan for Claude Code handoff
- Update roadmap progress for core infrastructure, ingestion, retrieval, and agent interface features.
- Fix mismatches and gaps
- Update ROADMAP
- Update Tech Debt register with recent fixes and new findings
- Finalize tech debt register updates for Phase 9
- Archive completed tech debt and create infrastructure roadmap
- Update roadmap with current progress and refined future phases, and remove conditional type checking from Qdrant adapter.
- Mark TEST-3 HTTP mocks as complete in TECH_DEBT.md after verifying respx migration and fixing regressions.
- Add a troubleshooting guide and document system prerequisites in the README.

### 🎨 Styling

- Fix linting issues (unused imports/variables, line length)

### 🧪 Testing

- Add test directory structure
- Add initial unit tests for CLI diff parsing
- Add integration tests for analyze_file API client logic

### ⚙️ Miscellaneous Tasks

- Add task list for Claude Code
- Remove development verification scripts
- Add py.typed markers for type checking
- Add .dockerignore to packages
- Add GitHub Actions workflow
- Chores and docs
- Remove CLAUDE_TASKS.md
- *(api)* Remove test endpoint to trigger ingestion
- Clean up test commit comments
- Expand `.gitignore` to exclude common build artifacts, virtual environments, and IDE/OS specific files.
- *(sweep)* Validate graph inputs, secure API key hashing, robust error logging
- Update tech debt journal
- Configure git-cliff for conventional commits
