better-code-review-graph 3.2.0__tar.gz → 3.3.0__tar.gz

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "better-code-review-graph",
   "description": "Persistent incremental knowledge graph for token-efficient code reviews",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "author": {
     "name": "n24q02m",
     "url": "https://github.com/n24q02m"

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/.github/workflows/cd.yml

@@ -40,22 +40,29 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Generate GitHub App Token
+        id: app-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3
+        with:
+          app-id: ${{ vars.CI_APP_ID }}
+          private-key: ${{ secrets.CI_APP_KEY }}
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
           fetch-depth: 0
 
       - uses: python-semantic-release/python-semantic-release@350c48fcb3ffcdfd2e0a235206bc2ecea6b69df0 # v10
         id: release
         with:
-          github_token: ${{ secrets.GH_PAT }}
+          github_token: ${{ steps.app-token.outputs.token }}
           prerelease: ${{ inputs.release_type == 'beta' }}
           prerelease_token: beta
 
       - uses: python-semantic-release/publish-action@310a9983a0ae878b29f3aac778d7c77c1db27378 # v10
         if: steps.release.outputs.released == 'true'
         with:
-          github_token: ${{ secrets.GH_PAT }}
+          github_token: ${{ steps.app-token.outputs.token }}
           tag: ${{ steps.release.outputs.tag }}
 
   # =================== Publish to PyPI ===================
@@ -77,8 +84,6 @@ jobs:
       - run: uv build
       - name: Publish to PyPI
         run: uv publish
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
 
   # =================== Build Docker ===================
   build-docker:

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/.github/workflows/ci.yml

@@ -66,10 +66,9 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: github.event_name == 'push'
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
         with:
           files: coverage.xml
-          token: ${{ secrets.CODECOV_TOKEN }}
 
   codeql:
     name: CodeQL Analysis
@@ -91,12 +90,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
+        uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
         with:
           languages: python
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
+        uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699 # v3
 
   dependency-review:
     name: Dependency Review
@@ -134,6 +133,7 @@ jobs:
       issues: write
       pull-requests: write
       contents: read
+      id-token: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -148,11 +148,18 @@ jobs:
             echo "$RANDOM_EOF" >> "$GITHUB_ENV"
           fi
 
+      - name: Authenticate to GCP (Vertex AI)
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.VERTEX_WIF_PROVIDER }}
+          service_account: ${{ vars.VERTEX_SERVICE_ACCOUNT }}
+
       - name: PR Agent action step
         uses: qodo-ai/pr-agent@42d55d4182a4839820b11b6c4d06fce855970301 # main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          VERTEXAI_PROJECT: ${{ vars.VERTEX_PROJECT }}
+          VERTEXAI_LOCATION: us-central1
           PR_REVIEWER__EXTRA_INSTRUCTIONS: ${{ env.CUSTOM_INSTRUCTIONS }}
           PR_CODE_SUGGESTIONS__EXTRA_INSTRUCTIONS: ${{ env.CUSTOM_INSTRUCTIONS }}
           PR_DESCRIPTION__EXTRA_INSTRUCTIONS: ${{ env.CUSTOM_INSTRUCTIONS }}
@@ -238,16 +245,23 @@ jobs:
             } >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Parse SMTP credential
+        run: |
+          echo "SMTP_USER=${SMTP_CREDENTIAL%%:*}" >> $GITHUB_ENV
+          echo "SMTP_PASS=${SMTP_CREDENTIAL#*:}" >> $GITHUB_ENV
+        env:
+          SMTP_CREDENTIAL: ${{ secrets.SMTP_CREDENTIAL }}
+
       - name: Send email notification
         uses: dawidd6/action-send-mail@d38f3f7cd391cdebfe0d38efc3998b935e951c4f # v16
         with:
           server_address: smtp.gmail.com
           server_port: 587
-          username: ${{ secrets.SMTP_USERNAME }}
-          password: ${{ secrets.SMTP_PASSWORD }}
+          username: ${{ env.SMTP_USER }}
+          password: ${{ env.SMTP_PASS }}
           subject: "[${{ github.event.repository.name }}] ${{ steps.data.outputs.event_type }} #${{ steps.data.outputs.number }}: ${{ steps.data.outputs.title }}"
-          to: ${{ secrets.NOTIFY_EMAIL }}
-          from: GitHub Notify <${{ secrets.SMTP_USERNAME }}>
+          to: ${{ env.SMTP_USER }}
+          from: GitHub Notify <${{ env.SMTP_USER }}>
           body: |
             New ${{ steps.data.outputs.event_type }} in ${{ github.repository }}
 

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/.gitignore

@@ -32,6 +32,10 @@ env/
 .DS_Store
 Thumbs.db
 
+# Secrets / env
+.env
+.env.*
+
 # Claude Code
 .claude/
 

better_code_review_graph-3.3.0/.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2023-10-24 - [Path Traversal in tools.py and incremental.py]
+**Vulnerability:** Found Path Traversal vulnerability where user input (file paths) was concatenated to paths (`root / rel_path`) without ensuring they don't escape the project root directory.
+**Learning:** Concatenating path components using `/` without checking for bounds allows reading or modifying unauthorized system files.
+**Prevention:** To prevent this, always build paths using `(base_path / user_path).resolve()` and explicitly verify boundaries using `if not resolved_path.is_relative_to(base_path.resolve()): continue`.

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
   # Security: Secret Detection (MUST be first — blocks commit if secrets found)
   # ============================================================================
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
     hooks:
       - id: gitleaks
         name: gitleaks (detect secrets)
@@ -26,7 +26,7 @@ repos:
 
   # Ruff: Fast Python linter and formatter
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.7
+    rev: e05c5c0818279e5ac248ac9e954431ba58865e61 # v0.15.7
     hooks:
       - id: ruff
         name: ruff lint
@@ -59,7 +59,7 @@ repos:
   # ============================================================================
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # v5.0.0
     hooks:
       - id: trailing-whitespace
         name: trim trailing whitespace

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/Dockerfile

@@ -1,12 +1,12 @@
 # syntax=docker/dockerfile:1
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS builder
+FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca AS builder
 WORKDIR /app
 COPY pyproject.toml uv.lock README.md ./
 RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev --no-editable
 COPY src/ src/
 
-FROM python:3.13-slim-bookworm
+FROM python:3.13-slim-bookworm@sha256:01f42367a0a94ad4bc17111776fd66e3500c1d87c15bbd6055b7371d39c124fb
 LABEL io.modelcontextprotocol.server.name="io.github.n24q02m/better-code-review-graph"
 RUN groupadd -r appuser && useradd -r -g appuser -d /app appuser
 WORKDIR /app

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: better-code-review-graph
-Version: 3.2.0
+Version: 3.3.0
 Summary: Knowledge graph for token-efficient code reviews — fixed search, configurable embeddings, qualified call resolution
 Author: n24q02m
 License-Expression: MIT
@@ -11,19 +11,19 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: ==3.13.*
-Requires-Dist: cohere>=5.20
-Requires-Dist: fastmcp<3,>=2.14.2
-Requires-Dist: google-genai>=1.0
+Requires-Dist: cohere>=5.21.1
+Requires-Dist: fastmcp<3,>=2.14.5
+Requires-Dist: google-genai>=1.68.0
 Requires-Dist: httpx
-Requires-Dist: mcp-relay-core>=0.1.0
-Requires-Dist: mcp<2,>=1.0.0
-Requires-Dist: networkx<4,>=3.2
-Requires-Dist: openai>=1.50
+Requires-Dist: mcp-relay-core>=1.0.5
+Requires-Dist: mcp<2,>=1.26.0
+Requires-Dist: networkx<4,>=3.6.1
+Requires-Dist: openai>=1.109.1
 Requires-Dist: pydantic-settings
-Requires-Dist: qwen3-embed>=1.5.0
-Requires-Dist: tree-sitter-language-pack<1,>=0.3.0
-Requires-Dist: tree-sitter<1,>=0.23.0
-Requires-Dist: watchdog<6,>=4.0.0
+Requires-Dist: qwen3-embed>=1.5.1
+Requires-Dist: tree-sitter-language-pack<1,>=0.13.0
+Requires-Dist: tree-sitter<1,>=0.25.2
+Requires-Dist: watchdog<6,>=4.0.2
 Description-Content-Type: text/markdown
 
 # Better Code Review Graph

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "better-code-review-graph",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "Persistent incremental knowledge graph for token-efficient code reviews",
   "mcpServers": {
     "better-code-review-graph": {

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "better-code-review-graph"
-version = "3.2.0"
+version = "3.3.0"
 description = "Knowledge graph for token-efficient code reviews — fixed search, configurable embeddings, qualified call resolution"
 readme = { file = "README.md", content-type = "text/markdown" }
 license = "MIT"
@@ -18,19 +18,19 @@ classifiers = [
     "Topic :: Software Development :: Quality Assurance",
 ]
 dependencies = [
-    "mcp>=1.0.0,<2",
-    "fastmcp>=2.14.2,<3",
-    "tree-sitter>=0.23.0,<1",
-    "tree-sitter-language-pack>=0.3.0,<1",
-    "networkx>=3.2,<4",
-    "watchdog>=4.0.0,<6",
-    "qwen3-embed>=1.5.0",
-    "cohere>=5.20",
-    "google-genai>=1.0",
-    "openai>=1.50",
+    "mcp>=1.26.0,<2",
+    "fastmcp>=2.14.5,<3",
+    "tree-sitter>=0.25.2,<1",
+    "tree-sitter-language-pack>=0.13.0,<1",
+    "networkx>=3.6.1,<4",
+    "watchdog>=4.0.2,<6",
+    "qwen3-embed>=1.5.1",
+    "cohere>=5.21.1",
+    "google-genai>=1.68.0",
+    "openai>=1.109.1",
     "httpx",
     "pydantic-settings",
-    "mcp-relay-core>=0.1.0",
+    "mcp-relay-core>=1.0.5",
 ]
 
 [project.scripts]
@@ -38,13 +38,13 @@ better-code-review-graph = "better_code_review_graph.cli:main"
 
 [dependency-groups]
 dev = [
-    "pytest>=8.0,<9",
-    "pytest-asyncio>=0.23,<1",
+    "pytest>=8.4.2,<9",
+    "pytest-asyncio>=0.26.0,<1",
     "pytest-cov",
     "pytest-timeout",
-    "ruff>=0.8.6",
+    "ruff>=0.15.8",
     "syrupy",
-    "ty>=0.0.1a10",
+    "ty>=0.0.26",
 ]
 
 [tool.hatch.build.targets.wheel]

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/n24q02m/better-code-review-graph.git",
     "source": "github"
   },
-  "version": "3.2.0",
+  "version": "3.3.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "better-code-review-graph",
-      "version": "3.2.0",
+      "version": "3.3.0",
       "runtimeHint": "uvx",
       "runtimeArgs": [
         "--python",

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/src/better_code_review_graph/incremental.py

@@ -214,10 +214,13 @@ def collect_all_files(repo_root: Path) -> list[str]:
     for rel_path in candidates:
         if _should_ignore(rel_path, ignore_patterns):
             continue
-        full_path = repo_root / rel_path
+        full_path_raw = repo_root / rel_path
+        full_path = full_path_raw.resolve()
+        if not full_path.is_relative_to(repo_root.resolve()):
+            continue
         if not full_path.is_file():
             continue
-        if full_path.is_symlink():
+        if full_path_raw.is_symlink() or full_path.is_symlink():
             continue
         if parser.detect_language(full_path) is None:
             continue
@@ -269,7 +272,9 @@ def full_build(repo_root: Path, store: GraphStore) -> dict:
     file_count = len(files)
 
     for i, rel_path in enumerate(files, 1):
-        full_path = repo_root / rel_path
+        full_path = (repo_root / rel_path).resolve()
+        if not full_path.is_relative_to(repo_root.resolve()):
+            continue
         try:
             source = full_path.read_bytes()
             fhash = hashlib.sha256(source).hexdigest()
@@ -342,11 +347,16 @@ def incremental_update(
     for rel_path in all_files:
         if _should_ignore(rel_path, ignore_patterns):
             continue
-        abs_path = repo_root / rel_path
+        abs_path_raw = repo_root / rel_path
+        abs_path = abs_path_raw.resolve()
+        if not abs_path.is_relative_to(repo_root.resolve()):
+            continue
         if not abs_path.is_file():
             # File was deleted
             store.remove_file_data(str(abs_path))
             continue
+        if abs_path_raw.is_symlink() or abs_path.is_symlink():
+            continue
         if parser.detect_language(abs_path) is None:
             continue
 

{better_code_review_graph-3.2.0 → better_code_review_graph-3.3.0}/src/better_code_review_graph/parser.py

@@ -990,71 +990,105 @@ class CodeParser:
 
     def _extract_import(self, node, language: str, source: bytes) -> list[str]:
         """Extract import targets as module/path strings."""
-        imports = []
         text = node.text.decode("utf-8", errors="replace").strip()
 
         if language == "python":
-            # import x.y.z  or  from x.y import z
-            if node.type == "import_from_statement":
-                for child in node.children:
-                    if child.type == "dotted_name":
-                        imports.append(child.text.decode("utf-8", errors="replace"))
-                        break
-            else:
-                for child in node.children:
-                    if child.type == "dotted_name":
-                        imports.append(child.text.decode("utf-8", errors="replace"))
+            return self._extract_import_python(node)
         elif language in ("javascript", "typescript", "tsx"):
-            # import ... from 'module'
-            for child in node.children:
-                if child.type == "string":
-                    val = child.text.decode("utf-8", errors="replace").strip("'\"")
-                    imports.append(val)
+            return self._extract_import_javascript(node)
         elif language == "go":
-            for child in node.children:
-                if child.type == "import_spec_list":
-                    for spec in child.children:
-                        if spec.type == "import_spec":
-                            for s in spec.children:
-                                if s.type == "interpreted_string_literal":
-                                    val = s.text.decode("utf-8", errors="replace")
-                                    imports.append(val.strip('"'))
-                elif child.type == "import_spec":
-                    for s in child.children:
-                        if s.type == "interpreted_string_literal":
-                            val = s.text.decode("utf-8", errors="replace")
-                            imports.append(val.strip('"'))
+            return self._extract_import_go(node)
         elif language == "rust":
-            # use crate::module::item
-            imports.append(text.replace("use ", "").rstrip(";").strip())
+            return self._extract_import_rust(text)
         elif language in ("c", "cpp"):
-            # #include <header> or #include "header"
-            for child in node.children:
-                if child.type in ("system_lib_string", "string_literal"):
-                    val = child.text.decode("utf-8", errors="replace").strip('<>"')
-                    imports.append(val)
+            return self._extract_import_c(node)
         elif language in ("java", "csharp"):
-            # import/using package.Class
-            parts = text.split()
-            if len(parts) >= 2:
-                imports.append(parts[-1].rstrip(";"))
+            return self._extract_import_java(text)
         elif language == "solidity":
-            # import "path/to/file.sol" or import {Symbol} from "path"
-            for child in node.children:
-                if child.type == "string":
-                    val = child.text.decode("utf-8", errors="replace").strip('"')
-                    if val:
-                        imports.append(val)
+            return self._extract_import_solidity(node)
         elif language == "ruby":
-            # require 'module' or require_relative 'path'
-            if "require" in text:
-                match = re.search(r"""['"](.*?)['"]""", text)
-                if match:
-                    imports.append(match.group(1))
+            return self._extract_import_ruby(text)
         else:
-            # Fallback: just record the text
-            imports.append(text)
+            return [text]
 
+    def _extract_import_python(self, node) -> list[str]:
+        imports = []
+        # import x.y.z  or  from x.y import z
+        if node.type == "import_from_statement":
+            for child in node.children:
+                if child.type == "dotted_name":
+                    imports.append(child.text.decode("utf-8", errors="replace"))
+                    break
+        else:
+            for child in node.children:
+                if child.type == "dotted_name":
+                    imports.append(child.text.decode("utf-8", errors="replace"))
+        return imports
+
+    def _extract_import_javascript(self, node) -> list[str]:
+        imports = []
+        # import ... from 'module'
+        for child in node.children:
+            if child.type == "string":
+                val = child.text.decode("utf-8", errors="replace").strip("'\"")
+                imports.append(val)
+        return imports
+
+    def _extract_import_go(self, node) -> list[str]:
+        imports = []
+        for child in node.children:
+            if child.type == "import_spec_list":
+                for spec in child.children:
+                    if spec.type == "import_spec":
+                        for s in spec.children:
+                            if s.type == "interpreted_string_literal":
+                                val = s.text.decode("utf-8", errors="replace")
+                                imports.append(val.strip('"'))
+            elif child.type == "import_spec":
+                for s in child.children:
+                    if s.type == "interpreted_string_literal":
+                        val = s.text.decode("utf-8", errors="replace")
+                        imports.append(val.strip('"'))
+        return imports
+
+    def _extract_import_rust(self, text: str) -> list[str]:
+        # use crate::module::item
+        return [text.replace("use ", "").rstrip(";").strip()]
+
+    def _extract_import_c(self, node) -> list[str]:
+        imports = []
+        # #include <header> or #include "header"
+        for child in node.children:
+            if child.type in ("system_lib_string", "string_literal"):
+                val = child.text.decode("utf-8", errors="replace").strip('<>"')
+                imports.append(val)
+        return imports
+
+    def _extract_import_java(self, text: str) -> list[str]:
+        imports = []
+        # import/using package.Class
+        parts = text.split()
+        if len(parts) >= 2:
+            imports.append(parts[-1].rstrip(";"))
+        return imports
+
+    def _extract_import_solidity(self, node) -> list[str]:
+        imports = []
+        # import "path/to/file.sol" or import {Symbol} from "path"
+        for child in node.children:
+            if child.type == "string":
+                val = child.text.decode("utf-8", errors="replace").strip('"')
+                if val:
+                    imports.append(val)
+        return imports
+
+    def _extract_import_ruby(self, text: str) -> list[str]:
+        imports = []
+        # require 'module' or require_relative 'path'
+        if "require" in text:
+            match = re.search(r"""['"](.*?)['"]""", text)
+            if match:
+                imports.append(match.group(1))
         return imports
 
     def _get_call_name(self, node, language: str, source: bytes) -> str | None:

better_code_review_graph-3.3.0/src/better_code_review_graph/relay_schema.py

@@ -0,0 +1,47 @@
+"""Config schema for relay page setup."""
+
+from mcp_relay_core.schema.types import ConfigField, RelayConfigSchema
+
+RELAY_SCHEMA: RelayConfigSchema = {
+    "server": "better-code-review-graph",
+    "displayName": "Code Review Graph",
+    "description": "At least one API key required for cloud embeddings. Priority: Jina > Gemini > OpenAI > Cohere. Skip for local ONNX mode.",
+    "fields": [
+        ConfigField(
+            key="JINA_AI_API_KEY",
+            label="Jina AI API Key",
+            type="password",
+            placeholder="jina_...",
+            helpUrl="https://jina.ai/embeddings/",
+            helpText="Highest priority. Embedding + reranking.",
+            required=False,
+        ),
+        ConfigField(
+            key="GEMINI_API_KEY",
+            label="Gemini API Key",
+            type="password",
+            placeholder="AIza...",
+            helpUrl="https://aistudio.google.com/apikey",
+            helpText="Embedding via Google Gemini. Free tier available.",
+            required=False,
+        ),
+        ConfigField(
+            key="OPENAI_API_KEY",
+            label="OpenAI API Key",
+            type="password",
+            placeholder="sk-...",
+            helpUrl="https://platform.openai.com/api-keys",
+            helpText="Embedding only.",
+            required=False,
+        ),
+        ConfigField(
+            key="COHERE_API_KEY",
+            label="Cohere API Key",
+            type="password",
+            placeholder="",
+            helpUrl="https://dashboard.cohere.com/api-keys",
+            helpText="Embedding + reranking.",
+            required=False,
+        ),
+    ],
+}