HivemindOS manual

Code Intelligence

Code Intelligence lets agents understand a codebase and your HivemindOS setup. They can search symbols, trace who calls what, summarize architecture, and check what a change might break. This page is for developers and agent builders.

Two layers

Code Intelligence (for builders): call graphs, diff impact, route tracing, and architecture. It uses the optional codebase-memory-mcp engine when installed.
System Intelligence (for everyone): a map of how your routes, Hive actions, MCP tools, and connected fleet apps fit together. It works without the engine.

The optional engine

HivemindOS uses the engine only when it is installed and the repository has been indexed. Otherwise it answers from a built-in live scan and marks results degraded, with a hint on how to improve them.

The engine is never installed or trusted automatically. HivemindOS only uses a configured path, a known install location, or a binary on your PATH that answers --version.
Its status is reported as available, missing, or unhealthy.
Set CODE_INTEL_DISABLE_ENGINE=1 to turn it off completely.
It runs without a shell, limited to the validated workspace, with timeouts and an output cap. Its output is treated as untrusted.
Its graph cache lives in ~/.hivemindos/code-intelligence/, never in the repository or browser storage.

API: `POST /api/code-intelligence`

Send { action, ...params }. Every repoPath defaults to the current checkout and must be inside the allowed workspace.

Action	Purpose
`status`	Engine availability, version, index state, and capabilities.
`index-repository`	Build or refresh the saved graph (engine only).
`search-graph`	Find symbols or routes by name or query.
`trace-path`	Show a function’s callers and callees.
`detect-changes`	Diff impact: touched files, affected symbols and routes, callers, dependencies, tests, and risk.
`get-architecture`	A structural summary plus a map of routes across services.
`get-code-snippet`	Source for a symbol or a file and line range.

MCP tools

hivemind-mcp exposes six tools that call the API above:

Read-only: code_search_graph, code_trace_path, code_get_architecture, code_get_snippet, code_detect_changes.
Writes the index: code_index_repository (marked destructive).

The context index also gains code-symbol, code-route, and repo-architecture entries: one architecture summary plus a capped set of exported symbols, so agents know when to call the code_* tools.

Diff impact

Use detect-changes for code review, pull-request summaries, or “what did I break?”. With the engine, it adds callers and dependencies for each touched file. Risk is rated low, medium, high, or critical, and changes to auth, wallet, credential, or signing code always raise the risk.

Security and limits

Credentials aren’t meant to reach the graph. The engine respects .gitignore, and .cbmignore also excludes .env files, private keys and certificates, service-account files, and Operations/Secure. Secrets hard-coded in normal source files are still your responsibility.
The graph is not committed to the repository.
Graph databases are not part of durable Shared Brain Memory.
Graph queries add depth to normal text search (rg); they don’t replace it.