agent-coderag 1.3.1__tar.gz → 1.3.2__tar.gz

{agent_coderag-1.3.1/agent_coderag.egg-info → agent_coderag-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-coderag
-Version: 1.3.1
+Version: 1.3.2
 Summary: Lightweight semantic code search and distillation utility for AI coding agents. It solves the API knowledge gap via real-time local signature extraction and intent analysis without PyTorch. Optimized for token efficiency, it compresses codebase context into compact semantic summaries stored in a local DuckDB vector similarity index.
 Author-email: Igor Boloban <naranor@gmail.com>
 License: MIT
@@ -24,7 +24,7 @@ License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: duckdb
 Requires-Dist: numpy
-Requires-Dist: litellm
+Requires-Dist: litellm==1.96.2
 Requires-Dist: onnxruntime
 Requires-Dist: tokenizers
 Requires-Dist: pydantic
@@ -123,10 +123,17 @@ If you don't configure an LLM provider, agent-coderag works in **100% Offline Mo
 # Index your entire project (respects .gitignore automatically)
 agent-coderag sync --all
 
+# Trusted Maven/Gradle projects only: allow dependency resolution
+agent-coderag sync --all --allow-build-execution
+
 # Perform a semantic search
 agent-coderag search "how does the authentication middleware work?"
 ```
 
+Dependency build execution is disabled by default. Maven and Gradle build files
+can execute repository-controlled code, so use `--allow-build-execution` only
+after you have reviewed and trust the project.
+
 ### API Discovery
 Verify external library signatures without leaving the CLI:
 ```bash
@@ -146,7 +153,7 @@ agent-coderag api fmt
 | Language | Method | Discovery Source |
 | :--- | :--- | :--- |
 | **Python** | 3-Stage Probe | `.pyi` stubs, static source, or runtime `inspect` |
-| **Java** | Bytecode Reflection | JARs resolved via Maven (`pom.xml`) or Gradle |
+| **Java** | Bytecode Reflection | JARs resolved via Maven or Gradle with explicit `--allow-build-execution` opt-in |
 | **Go** | Standard Tooling | Native `go doc -all` integration |
 | **TypeScript/JS** | Declaration Maps | `.d.ts` files from `node_modules` or `@types` |
 | **Rust** | Registry Analysis | Source code from Cargo registry via `cargo metadata` |

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/README.md

@@ -78,10 +78,17 @@ If you don't configure an LLM provider, agent-coderag works in **100% Offline Mo
 # Index your entire project (respects .gitignore automatically)
 agent-coderag sync --all
 
+# Trusted Maven/Gradle projects only: allow dependency resolution
+agent-coderag sync --all --allow-build-execution
+
 # Perform a semantic search
 agent-coderag search "how does the authentication middleware work?"
 ```
 
+Dependency build execution is disabled by default. Maven and Gradle build files
+can execute repository-controlled code, so use `--allow-build-execution` only
+after you have reviewed and trust the project.
+
 ### API Discovery
 Verify external library signatures without leaving the CLI:
 ```bash
@@ -101,7 +108,7 @@ agent-coderag api fmt
 | Language | Method | Discovery Source |
 | :--- | :--- | :--- |
 | **Python** | 3-Stage Probe | `.pyi` stubs, static source, or runtime `inspect` |
-| **Java** | Bytecode Reflection | JARs resolved via Maven (`pom.xml`) or Gradle |
+| **Java** | Bytecode Reflection | JARs resolved via Maven or Gradle with explicit `--allow-build-execution` opt-in |
 | **Go** | Standard Tooling | Native `go doc -all` integration |
 | **TypeScript/JS** | Declaration Maps | `.d.ts` files from `node_modules` or `@types` |
 | **Rust** | Registry Analysis | Source code from Cargo registry via `cargo metadata` |

{agent_coderag-1.3.1 → agent_coderag-1.3.2/agent_coderag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-coderag
-Version: 1.3.1
+Version: 1.3.2
 Summary: Lightweight semantic code search and distillation utility for AI coding agents. It solves the API knowledge gap via real-time local signature extraction and intent analysis without PyTorch. Optimized for token efficiency, it compresses codebase context into compact semantic summaries stored in a local DuckDB vector similarity index.
 Author-email: Igor Boloban <naranor@gmail.com>
 License: MIT
@@ -24,7 +24,7 @@ License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: duckdb
 Requires-Dist: numpy
-Requires-Dist: litellm
+Requires-Dist: litellm==1.96.2
 Requires-Dist: onnxruntime
 Requires-Dist: tokenizers
 Requires-Dist: pydantic
@@ -123,10 +123,17 @@ If you don't configure an LLM provider, agent-coderag works in **100% Offline Mo
 # Index your entire project (respects .gitignore automatically)
 agent-coderag sync --all
 
+# Trusted Maven/Gradle projects only: allow dependency resolution
+agent-coderag sync --all --allow-build-execution
+
 # Perform a semantic search
 agent-coderag search "how does the authentication middleware work?"
 ```
 
+Dependency build execution is disabled by default. Maven and Gradle build files
+can execute repository-controlled code, so use `--allow-build-execution` only
+after you have reviewed and trust the project.
+
 ### API Discovery
 Verify external library signatures without leaving the CLI:
 ```bash
@@ -146,7 +153,7 @@ agent-coderag api fmt
 | Language | Method | Discovery Source |
 | :--- | :--- | :--- |
 | **Python** | 3-Stage Probe | `.pyi` stubs, static source, or runtime `inspect` |
-| **Java** | Bytecode Reflection | JARs resolved via Maven (`pom.xml`) or Gradle |
+| **Java** | Bytecode Reflection | JARs resolved via Maven or Gradle with explicit `--allow-build-execution` opt-in |
 | **Go** | Standard Tooling | Native `go doc -all` integration |
 | **TypeScript/JS** | Declaration Maps | `.d.ts` files from `node_modules` or `@types` |
 | **Rust** | Registry Analysis | Source code from Cargo registry via `cargo metadata` |

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/agent_coderag.egg-info/requires.txt

@@ -1,6 +1,6 @@
 duckdb
 numpy
-litellm
+litellm==1.96.2
 onnxruntime
 tokenizers
 pydantic

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/code_rag/core/manager.py

@@ -25,11 +25,13 @@ class CodeRAGManager:
         parser: IParser,
         intelligence: IIntelligence,
         max_concurrency: int = MAX_CONCURRENT_TASKS,
+        allow_build_execution: bool = False,
     ):
         self.storage = storage
         self.parser = parser
         self.intelligence = intelligence
         self.max_concurrency = max_concurrency
+        self.allow_build_execution = allow_build_execution
         self.semaphore = asyncio.Semaphore(max_concurrency)
         self.discovery = DiscoveryManager(storage=storage)
 
@@ -41,6 +43,17 @@ class CodeRAGManager:
         pom_xml = root / "pom.xml"
         gradle_files = list(root.glob("build.gradle*"))
 
+        if not pom_xml.exists() and not gradle_files:
+            return
+
+        if not self.allow_build_execution:
+            logger.warning(
+                "Dependency sync is disabled by default because Maven/Gradle "
+                "build files are executable repository code. Use the explicit "
+                "allow_build_execution option only for trusted projects."
+            )
+            return
+
         if pom_xml.exists():
             await self._sync_maven(root)
         elif gradle_files:

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/code_rag/entry/cli.py

@@ -61,7 +61,11 @@ async def sync_cmd(args):
     if args.path:
         args.path = str(validate_path(args.path))
 
-    manager = get_manager(args.db, args.onnx)
+    manager = get_manager(
+        args.db,
+        args.onnx,
+        allow_build_execution=getattr(args, "allow_build_execution", False),
+    )
     try:
         ignore_spec = load_ignore_patterns()
 
@@ -244,7 +248,11 @@ async def rebuild_cmd(args):
     await sync_cmd(args)
 
 
-def get_manager(db_path: str, onnx_path: Optional[str] = None) -> CodeRAGManager:
+def get_manager(
+    db_path: str,
+    onnx_path: Optional[str] = None,
+    allow_build_execution: bool = False,
+) -> CodeRAGManager:
     # 1. Setup Intelligence
     config = DistillerConfig.load()
     distiller = Distiller(config)
@@ -256,7 +264,12 @@ def get_manager(db_path: str, onnx_path: Optional[str] = None) -> CodeRAGManager
     # 3. Setup Parser
     parser = MultiParser()
 
-    return CodeRAGManager(storage, parser, distiller)
+    return CodeRAGManager(
+        storage,
+        parser,
+        distiller,
+        allow_build_execution=allow_build_execution,
+    )
 
 
 def main():
@@ -277,6 +290,11 @@ def main():
     sync.add_argument("path", nargs="?", help="File or directory to index.")
     sync.add_argument("--all", action="store_true", help="Index all supported files.")
     sync.add_argument("--force", action="store_true", help="Force re-distillation.")
+    sync.add_argument(
+        "--allow-build-execution",
+        action="store_true",
+        help="Execute repository Maven/Gradle build files during dependency sync (trusted projects only).",
+    )
 
     # Search
     search = subparsers.add_parser("search", help="Semantic search.")

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-coderag"
-version = "1.3.1"
+version = "1.3.2"
 description = "Lightweight semantic code search and distillation utility for AI coding agents. It solves the API knowledge gap via real-time local signature extraction and intent analysis without PyTorch. Optimized for token efficiency, it compresses codebase context into compact semantic summaries stored in a local DuckDB vector similarity index."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -27,7 +27,7 @@ classifiers = [
 dependencies = [
     "duckdb",
     "numpy",
-    "litellm",
+    "litellm==1.96.2",
     "onnxruntime",
     "tokenizers",
     "pydantic",

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/tests/test_cli.py

@@ -86,6 +86,32 @@ class TestCLISync:
             finally:
                 sys.stdout = old_stdout
 
+    @pytest.mark.asyncio
+    async def test_sync_cmd_propagates_build_execution_flag(self, tmp_path):
+        """Test the --allow-build-execution opt-in reaches the manager."""
+        mock_manager = MagicMock()
+        mock_manager.sync_project = AsyncMock()
+        mock_manager.sync_dependencies = AsyncMock()
+        mock_manager.close = AsyncMock()
+
+        with patch(
+            "code_rag.entry.cli.get_manager", return_value=mock_manager
+        ) as mock_get_manager:
+            args = argparse.Namespace(
+                db=str(tmp_path / "test.db"),
+                onnx=None,
+                verbose=False,
+                json=False,
+                path=None,
+                all=True,
+                force=False,
+                allow_build_execution=True,
+            )
+
+            await cli.sync_cmd(args)
+
+            assert mock_get_manager.call_args.kwargs["allow_build_execution"] is True
+
     @pytest.mark.asyncio
     async def test_sync_cmd_file(self, tmp_path):
         """Test sync command for a single file."""

{agent_coderag-1.3.1 → agent_coderag-1.3.2}/tests/test_manager_detailed.py

@@ -1,7 +1,9 @@
-import pytest
+import logging
 import os
 from unittest.mock import MagicMock, AsyncMock, patch
 
+import pytest
+
 from code_rag.core.manager import CodeRAGManager
 from code_rag.core.interfaces import IStorage, IParser, IIntelligence
 from code_rag.core.models import KnowledgeUnit, UnitKind
@@ -44,6 +46,7 @@ class TestManagerDetailed:
     @pytest.mark.asyncio
     async def test_sync_dependencies_maven(self, manager, tmp_path):
         """Test Maven dependency synchronization."""
+        manager.allow_build_execution = True
         (tmp_path / "pom.xml").write_text("<project></project>")
 
         with patch("shutil.which", return_value="/usr/bin/mvn"), patch(
@@ -68,6 +71,7 @@ class TestManagerDetailed:
     @pytest.mark.asyncio
     async def test_sync_dependencies_gradle(self, manager, tmp_path):
         """Test Gradle dependency synchronization."""
+        manager.allow_build_execution = True
         (tmp_path / "build.gradle").write_text("apply plugin: 'java'")
 
         with patch("shutil.which", return_value="/usr/bin/gradle"), patch(
@@ -85,6 +89,31 @@ class TestManagerDetailed:
                 "lib-gradle", "lib-gradle.jar"
             )
 
+    @pytest.mark.asyncio
+    async def test_sync_dependencies_non_java_does_not_warn(
+        self, manager, tmp_path, caplog
+    ):
+        """Test dependency synchronization stays quiet without build files."""
+        with caplog.at_level(logging.WARNING):
+            await manager.sync_dependencies(str(tmp_path))
+
+        assert not caplog.records
+
+    @pytest.mark.asyncio
+    async def test_sync_dependencies_requires_build_execution_opt_in(
+        self, manager, tmp_path, caplog
+    ):
+        """Test repository build files are not executed without explicit opt-in."""
+        (tmp_path / "pom.xml").write_text("<project></project>")
+
+        with caplog.at_level(logging.WARNING), patch(
+            "asyncio.create_subprocess_exec"
+        ) as mock_exec:
+            await manager.sync_dependencies(str(tmp_path))
+
+        mock_exec.assert_not_called()
+        assert "Dependency sync is disabled by default" in caplog.text
+
     @pytest.mark.asyncio
     async def test_sync_file_delta_logic(self, manager, mock_storage, mock_parser):
         """Test sync_file with delta distillation logic."""