# Release Note for v5.17.0 — Codebase Comprehension Pre-Flight (Code Map)

The AI now reads your codebase **before** it writes — a tree-sitter Code Map that feeds the quality gates and attacks the #1 vibe-coding failure (frontend/backend contract mismatch) proactively.

## Highlights

- **`sf_codemap` MCP tool** — `build` / `refresh` (incremental, default) / `query` / `diff-impact`. Tree-sitter parse of TS/JS + Python into a node/edge graph; cached at `.skillfoundry/code-map.json`.
- **`/preflight` command** (alias `/codemap`) + `agents/_codemap-preflight-protocol.md` (referenced from `CLAUDE.md`).
- **API contract surface** → `endpoints[]` (method, canonical `:param` path, handler, FastAPI request shapes) for Express/Fastify/Hono/Koa-router, Next.js App Router, NestJS, FastAPI, Flask.
- **Import graph + `unresolvedImports[]`**, and a **DB/layer map** — `model` nodes (Prisma/Drizzle/Mongoose/TypeORM/SQLAlchemy) + deterministic `db`/`backend`/`frontend`/`shared` tags.
- **Pipeline wiring** — `/forge` & `/go` IGNITE run `sf_codemap refresh`, then hand `endpoints[]` to `sf_contract_check` and `unresolvedImports[]` to `sf_import_validator`. Advisory: a failure logs a warning, never blocks.
- **Diff-impact / blast radius** — reverse traversal over imports/calls, cycle-safe.
- **Optional LLM semantic labels** — off by default, `confidence:"llm-hint"`, non-authoritative.
- **Dashboard Code Map explorer** — loopback-only `/api/codemap` + `/api/codemap/diff-impact`; responsive tab with layer view, search, and diff-impact overlay.
- **memory_bank feed** — sanitized, deduped `code-map` facts for cross-project learning.

## Notes

- New deps are pure WASM (`web-tree-sitter@^0.24.7`, `tree-sitter-wasms@^0.1.13`) — no native build; `npm ci` stays portable.
- Tool-agent count 22 → 23. 61 new tests across 12 suites; full MCP suite green.
- Dashboard server now binds `127.0.0.1` by default (`DASHBOARD_HOST`).
- Version bump across all package files, `.version`, MCP server, and CLI.

## Deferred follow-ups

Django `urls.py` routes; zod/TS-type/NestJS-DTO request shapes; ORM field extraction beyond Prisma/Drizzle; diff-impact base-ref param; semantic `domain` label + cost-router/budget routing; cross-platform mirroring of `/preflight`; medium-repo perf benchmark.
