better-code-review-graph 3.27.0__tar.gz → 3.27.2__tar.gz

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "better-code-review-graph",
   "description": "Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.",
-  "version": "3.27.0",
+  "version": "3.27.2",
   "userConfig": {
     "EMBEDDING_MODELS": {
       "type": "string",

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/.github/workflows/ci.yml

@@ -86,7 +86,7 @@ jobs:
           python-version: "3.13"
 
       - name: Install dependencies
-        run: uv sync --group dev --no-sources
+        run: uv sync --group dev
 
       - name: Run Ruff check
         run: uv run --no-sync ruff check .

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/AGENTS.md

@@ -7,12 +7,12 @@ See `AGENTS.md` va `README.md` de hieu architecture va configuration.
 ## Cau truc
 
 - `src/better_code_review_graph/` -- Package chinh (src layout)
-  - `server.py` -- FastMCP server, 7 tools: graph + query + review (3 main) + config + security + help + config__open_relay (mcp-core relay helper)
+  - `server.py` -- FastMCP server, 6 tools: graph + query + review (3 main) + config + security + help
   - `tools.py` -- MCP tool implementations (build, query, impact, review, search, embed, stats, docs, large functions)
   - `parser.py` -- Tree-sitter parsing (14 langs) + call target resolution
   - `graph.py` -- SQLite GraphStore, search, impact radius, NetworkX cache
   - `incremental.py` -- Git integration, file watching, incremental updates
-  - `embeddings.py` -- Dual-mode embedding: local ONNX through the fastretrieval registry + cloud chain (`EMBEDDING_MODELS`) via litellm passthrough (`mcp_core.llm`)
+  - `embeddings.py` -- Dual-mode embedding: local ONNX through the fastretrieval registry + cloud chain (`EMBEDDING_MODELS`) via OpenAI-compatible HTTP clients (`hull_core.providers`)
   - `docs/` -- Help tool documentation (graph.md, query.md, review.md, config.md)
 - `cli.py` -- local CLI: no args starts MCP stdio; positional subcommands expose graph/query/review/security over the same domain services
 
@@ -62,27 +62,26 @@ Source files --> Tree-sitter parser --> SQLite graph (nodes + edges)
                                           |
                                      Embedding store --> Semantic search
                                           |
-                                     FastMCP server --> secondary MCP adapter (7 tools: graph + query + review + config + security + help + config__open_relay)
+                                     FastMCP server --> secondary MCP adapter (6 tools: graph + query + review + config + security + help)
 ```
 
 - **Parser** (parser.py): Tree-sitter extracts nodes (File, Class, Function, Type, Test) and edges (CALLS, IMPORTS_FROM, INHERITS, IMPLEMENTS, CONTAINS, TESTED_BY, DEPENDS_ON). Resolves same-file bare call targets to qualified names.
 - **Graph** (graph.py): SQLite with WAL mode. Multi-word AND-logic search. GraphNode/GraphEdge dataclasses.
 - **Incremental** (incremental.py): Git diff detection, file hash tracking, re-parses only changed files.
-- **Embeddings** (embeddings.py): Dual-mode -- local ONNX through the fastretrieval registry (default, zero-config) or cloud via the `EMBEDDING_MODELS` chain (litellm passthrough, `mcp_core.llm`; order = fallback, empty = local). Fixed 768-dim storage.
+- **Embeddings** (embeddings.py): Dual-mode -- local ONNX through the fastretrieval registry (default, zero-config) or cloud via the `EMBEDDING_MODELS` chain (OpenAI-compatible HTTP clients; order = fallback, empty = local). Fixed 768-dim storage.
 - **Tools** (tools.py): Implementation layer for all graph operations. Output pagination via max_results.
-- **Server** (server.py): 7 tools — graph (build/update/stats/embed/export/summarize), query (query/search/impact/large_functions/spot_check/renamed_in_diff/diff), review, config, security, help, config__open_relay (mcp-core relay helper). Returns structured dict payloads over MCP; the CLI serializes them as JSON.
+- **Server** (server.py): 6 tools — graph (build/update/stats/embed/export/summarize), query (query/search/impact/large_functions/spot_check/renamed_in_diff/diff), review, config, security, help. Returns structured dict payloads over MCP; the CLI serializes them as JSON.
 
 ## Embedding backends
 
-Embedding (cloud backend) + the LLM summarizer both dispatch through
-`mcp_core.llm` (litellm passthrough, `n24q02m-mcp-core[llm]`). No native
-provider SDKs are imported directly.
+Embedding (cloud backend) + the LLM summarizer dispatch through
+OpenAI-compatible HTTP clients (`hull_core.providers.openai_spec`).
 
-Per-task model chains, CSV `provider/model,provider/model`, order = litellm fallback. Provider is inferred from the model prefix.
+Per-task model chains, CSV `provider/model,provider/model`, order = fallback. Provider is inferred from the model prefix.
 
 - `EMBEDDING_MODELS` -- chain embedding. Empty = local ONNX from the fastretrieval built-in registry.
 - **Local (default)**: fastretrieval ONNX registry -- zero-config, ~570MB download on first use, 768-dim MRL truncation
-- API key follows the litellm convention `<PROVIDER>_API_KEY`. The 7 providers the server suggests:
+- API key follows the `<PROVIDER>_API_KEY` convention. The 7 providers documented below:
 
   | model prefix | key env var | get it at |
   |---|---|---|
@@ -94,7 +93,6 @@ Per-task model chains, CSV `provider/model,provider/model`, order = litellm fall
   | `anthropic/` | `ANTHROPIC_API_KEY` | console.anthropic.com |
   | `vertex_express/` | `GOOGLE_VERTEX_EXPRESS_API_KEY` | cloud.google.com/vertex-ai/generative-ai/docs/start/express-mode/overview |
 
-  For any other litellm provider (used via env passthrough), see https://docs.litellm.ai/docs/providers/<provider> for its `<PROVIDER>_API_KEY` name.
 - Custom endpoint (SSRF-guarded): `EMBEDDING_API_BASE` -- custom OpenAI-compatible base URL for cloud embedding (optional)
 - `DISABLE_LOCAL_EMBED` -- skip the local ONNX download; embedding is `unavailable` unless a cloud chain is configured (`resolve_backend` 3-way: cloud / local / unavailable)
 - Fixed 768-dim storage keeps the table schema valid across providers. Switching embedding MODEL changes the vector space; embeddings are tagged per provider (`embeddings.provider` column) and `EmbeddingStore.search` restricts the cosine scan to the active provider, so a provider switch just re-embeds rather than mixing incomparable vectors.
@@ -132,8 +130,8 @@ chối, không tự rơi về model mặc định.
 
 ## LLM summarizer (graph `summarize` action)
 
-- `SUMMARY_MODELS` -- ordered summarizer model chain (CSV `provider/model,...`, order = litellm fallback). Empty = summaries disabled. Provider is inferred from the model prefix and must expose a chat-completion API (Jina/Cohere do not).
-- Dispatches through `mcp_core.llm.completion`.
+- `SUMMARY_MODELS` -- ordered summarizer model chain (CSV `provider/model,...`, order = fallback). Empty = summaries disabled. Provider is inferred from the model prefix and must expose a chat-completion API (Jina/Cohere do not).
+- Dispatches through OpenAI-compatible chat completions (`hull_core.providers.openai_spec`).
 - `LLM_API_BASE` -- custom OpenAI-compatible base URL for the summarizer (SSRF-guarded, optional)
 - Deprecated (honored one release with a warning): singular `SUMMARY_MODEL` -- folded into `SUMMARY_MODELS`.
 
@@ -160,7 +158,7 @@ chối, không tự rơi về model mặc định.
 
 ## Luu y quan trong
 
-- Lazy imports cho heavy deps (tree-sitter, fastretrieval, litellm via `mcp_core.llm`, numpy) -- tranh startup cost
+- Lazy imports cho heavy deps (tree-sitter, fastretrieval, hull_core cloud clients, numpy) -- tranh startup cost
 - MCP tools return structured error payloads (`{"error": ...}`) and close local resources on every path.
 - GraphStore.upsert_edge takes EdgeInfo (fields: source, target), GraphEdge uses source_qualified/target_qualified
 - `_make_qualified()` builds qualified names as `file_path::name` or `file_path::parent.name`

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 <!-- version list -->
 
+## v3.27.2 (2026-09-26)
+
+### Bug Fixes
+
+- **deps**: Lock file maintenance ([#1095](https://github.com/n24q02m/crg/pull/1095),
+  [`56c05f2`](https://github.com/n24q02m/crg/commit/56c05f213efcdaeabd97fc96445d02017e44ade3))
+
+
+## v3.27.1 (2026-09-26)
+
+### Bug Fixes
+
+- **ci**: Keep uv sources for git-pinned hull-core
+  ([`0f8eec1`](https://github.com/n24q02m/crg/commit/0f8eec1ceddf33c93e40d299d750a2b8fd7eb3ae))
+
+### Chores
+
+- Re-pin hull-core for chat null-content fallback
+  ([`d2d890f`](https://github.com/n24q02m/crg/commit/d2d890f9d32362c2282e651f8a00f2bbab985ef1))
+
+- Scrub WP2 residuals (dead e2e script, open_relay string, doc sweep)
+  ([`debd924`](https://github.com/n24q02m/crg/commit/debd9247ec886cbe9322e0618ea475f83aecf6ac))
+
+
 ## v3.27.0 (2026-09-26)
 
 ### Bug Fixes

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/CLAUDE.md

@@ -7,14 +7,12 @@ See `AGENTS.md` va `README.md` de hieu architecture va configuration.
 ## Cau truc
 
 - `src/better_code_review_graph/` -- Package chinh (src layout)
-  - `server.py` -- FastMCP server, 7 tools: graph + query + review (3 main) + config (incl. setup_*) + security + help + config__open_relay (mcp-core relay helper)
+  - `server.py` -- FastMCP server, 6 tools: graph + query + review (3 main) + config (incl. setup_*) + security + help
   - `tools.py` -- MCP tool implementations (build, query, impact, review, search, embed, stats, docs, large functions)
   - `parser.py` -- Tree-sitter parsing (14 langs) + call target resolution
   - `graph.py` -- SQLite GraphStore, search, impact radius, NetworkX cache
   - `incremental.py` -- Git integration, file watching, incremental updates
-  - `embeddings.py` -- Dual-mode embedding: local ONNX through the fastretrieval registry + cloud chain (`EMBEDDING_MODELS`) via litellm passthrough (`mcp_core.llm`)
-  - `relay_setup.py` -- `apply_config` env-applier used by the OAuth setup form (live setup UX = OAuth-AS browser form at `<PUBLIC_URL>/authorize`; the `ensure_config` create-session/poll path is legacy/unused)
-  - `relay_schema.py` -- Relay form schema (embedding provider fields)
+  - `embeddings.py` -- Dual-mode embedding: local ONNX through the fastretrieval registry + cloud chain (`EMBEDDING_MODELS`) via OpenAI-compatible HTTP clients (`hull_core.providers`)
   - `docs/` -- Help tool documentation (graph.md, query.md, review.md, config.md, recipes.md, security.md)
 - `cli.py` -- local CLI: no args starts MCP stdio; positional subcommands expose graph/query/review/security over the same domain services
   - `__init__.py` -- Version export
@@ -62,27 +60,26 @@ Source files --> Tree-sitter parser --> SQLite graph (nodes + edges)
                                      NetworkX BFS --> Impact radius
                                           |
                                      Embedding store --> Semantic search
-                                     FastMCP server --> secondary MCP adapter (7 tools: graph + query + review + config + security + help + config__open_relay)
+                                     FastMCP server --> secondary MCP adapter (6 tools: graph + query + review + config + security + help)
 ```
 
 - **Parser** (parser.py): Tree-sitter extracts nodes (File, Class, Function, Type, Test) and edges (CALLS, IMPORTS_FROM, INHERITS, IMPLEMENTS, CONTAINS, TESTED_BY, DEPENDS_ON). Resolves same-file bare call targets to qualified names.
 - **Graph** (graph.py): SQLite with WAL mode. Multi-word AND-logic search. GraphNode/GraphEdge dataclasses.
 - **Incremental** (incremental.py): Git diff detection, file hash tracking, re-parses only changed files.
-- **Embeddings** (embeddings.py): Dual-mode -- local ONNX through the fastretrieval registry (default, zero-config) or cloud via the `EMBEDDING_MODELS` chain (litellm passthrough, `mcp_core.llm`; order = fallback, empty = local). Fixed 768-dim storage.
-- **Server** (server.py): 7 tools — graph (build/update/stats/embed/export/summarize), query (query/search/impact/large_functions/spot_check/renamed_in_diff/diff), review, config (status/set/cache_clear + setup_status/setup_start/setup_skip/setup_reset/setup_complete), security (scan/report/suppress/rule_list), help, config__open_relay (mcp-core relay helper). Returns structured dict payloads over MCP; the CLI serializes them as JSON.
+- **Embeddings** (embeddings.py): Dual-mode -- local ONNX through the fastretrieval registry (default, zero-config) or cloud via the `EMBEDDING_MODELS` chain (OpenAI-compatible HTTP clients; order = fallback, empty = local). Fixed 768-dim storage.
+- **Server** (server.py): 6 tools — graph (build/update/stats/embed/export/summarize), query (query/search/impact/large_functions/spot_check/renamed_in_diff/diff), review, config (status/set/cache_clear + setup_status/setup_start/setup_skip/setup_reset/setup_complete), security (scan/report/suppress/rule_list), help. Returns structured dict payloads over MCP; the CLI serializes them as JSON.
 
 ## Embedding + LLM backends
 
-Embedding (cloud backend) + the LLM summarizer dispatch through `mcp_core.llm`
-(litellm passthrough, `n24q02m-mcp-core[llm]`). No native provider SDKs are
-imported directly.
+Embedding (cloud backend) + the LLM summarizer dispatch through
+OpenAI-compatible HTTP clients (`hull_core.providers.openai_spec`).
 
-Per-task model chains, CSV `provider/model,provider/model`, order = litellm fallback. Provider is inferred from the model prefix.
+Per-task model chains, CSV `provider/model,provider/model`, order = fallback. Provider is inferred from the model prefix.
 
 - `EMBEDDING_MODELS` -- chain embedding. Empty = local ONNX from the fastretrieval built-in registry.
 - `SUMMARY_MODELS` -- chain summarizer (graph `summarize` action). Empty = summaries disabled.
 - **Local (default)**: fastretrieval ONNX registry -- zero-config, ~570MB download on first use, 768-dim MRL truncation
-- API key theo convention litellm `<PROVIDER>_API_KEY`. 7 provider servers goi y:
+- API key theo convention `<PROVIDER>_API_KEY`. 7 provider servers goi y:
 
   | model prefix | key env var | get it at |
   |---|---|---|
@@ -94,7 +91,7 @@ Per-task model chains, CSV `provider/model,provider/model`, order = litellm fall
   | `anthropic/` | `ANTHROPIC_API_KEY` | console.anthropic.com |
   | `vertex_express/` | `GOOGLE_VERTEX_EXPRESS_API_KEY` | cloud.google.com/vertex-ai/generative-ai/docs/start/express-mode/overview |
 
-  For any other litellm provider (used via env passthrough), see https://docs.litellm.ai/docs/providers/<provider> for its `<PROVIDER>_API_KEY` name. Summarizer providers must expose a chat-completion API (Jina/Cohere do not).
+  Summarizer providers must expose a chat-completion API (Jina/Cohere do not).
 - Custom endpoint (SSRF-guarded): `EMBEDDING_API_BASE` (embedding), `LLM_API_BASE` (summarizer)
 - `DISABLE_LOCAL_EMBED` -- skip local ONNX download; `resolve_backend` returns `unavailable` (not local) when no cloud chain is configured
 - Fixed 768-dim storage keeps the table schema valid across providers. Switching embedding MODEL changes the vector space; embeddings are tagged per provider and the cosine search restricts to the active provider, so a provider switch re-embeds rather than mixing incomparable vectors.
@@ -159,30 +156,8 @@ chối, không tự rơi về model mặc định.
 
 ## Luu y quan trong
 
-- Lazy imports cho heavy deps (tree-sitter, fastretrieval, litellm via `mcp_core.llm`, numpy) -- tranh startup cost
+- Lazy imports cho heavy deps (tree-sitter, fastretrieval, hull_core cloud clients, numpy) -- tranh startup cost
 - MCP tools return structured error payloads (`{"error": ...}`) and close local resources on every path.
 - GraphStore.upsert_edge takes EdgeInfo (fields: source, target), GraphEdge uses source_qualified/target_qualified
 - `_make_qualified()` builds qualified names as `file_path::name` or `file_path::parent.name`
 - Supported languages: Python, TypeScript, JavaScript, Go, Rust, Java, C#, Ruby, Kotlin, Swift, PHP, C/C++, Solidity
-
-## E2E
-
-Driven by `mcp-core/scripts/e2e/` (matrix-locked, 15 configs). Run a single config from this repo via `make e2e` (proxy) or directly:
-
-```
-cd ../mcp-core && uv run --project scripts/e2e python -m e2e.driver <config-id>
-```
-
-Configs for this repo: `crg`.
-
-t2-non-interaction: paste optional cloud LLM keys (Jina/Gemini/OpenAI/Cohere).
-
-Tier policy:
-
-- **T0** (precommit + CI on PR / main push) - runs without upstream identity. Skret keys not required.
-- **T2 non-interaction** (`make e2e-config CONFIG=<id>` locally) - driver pre-fills relay form from skret AWS SSM `/better-code-review-graph/prod` (`ap-southeast-1`). No user gate.
-- **T2 interaction** - driver fills relay form, then prints upstream user-gate URL; user signs in / types OTP at provider. Driver enforces per-flow timeouts (device-code 900s, oauth-redirect 300s, browser-form 600s) and emits `[poll] elapsed=Xs remaining=Ys status=<body>` every 30s. On timeout, container logs + last `setup-status` are saved to `<tmp>/e2e-diag/` BEFORE teardown for post-mortem.
-
-Multi-user remote mode (deployment property; not a separate config) requires `MCP_DCR_SERVER_SECRET` in the same skret namespace - driver refuses to start the container without it when `PUBLIC_URL` is set.
-
-References: `mcp-core/scripts/e2e/matrix.yaml`, `~/.claude/skills/mcp-dev/references/e2e-full-matrix.md` (harness-readiness gate), `~/.claude/skills/mcp-dev/references/secrets-skret.md` (per-server credential layout), `~/.claude/skills/mcp-dev/references/multi-user-pattern.md` (per-JWT-sub isolation).

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: better-code-review-graph
-Version: 3.27.0
+Version: 3.27.2
 Summary: Token-efficient code review knowledge graph: semantic search and call-graph resolution.
 Author: n24q02m
 License-Expression: Apache-2.0
@@ -243,9 +243,6 @@ another provider. Summarizers require a chat-completion model.
 | `openrouter/` | `OPENROUTER_API_KEY` | <https://openrouter.ai/settings/keys> |
 | `vertex_express/` | `GOOGLE_VERTEX_EXPRESS_API_KEY` | <https://cloud.google.com/vertex-ai/generative-ai/docs/start/express-mode/overview> |
 
-Any other [litellm provider](https://docs.litellm.ai/docs/providers) works via
-its standard `<PROVIDER>_API_KEY`.
-
 ### Advanced
 
 | Variable | Purpose |
@@ -296,39 +293,15 @@ not invoke the reranker.
 
 Cohere embedding is paid. Authorize a bounded budget before a live index/query;
 the Minimax-free completion choice does not make embeddings free. This example
-does not add a process-wide model override: in remote mode each authenticated
-subject's relay record supplies its models, endpoints and keys. Missing subject
-credentials fail closed rather than inheriting the server environment.
+does not add a process-wide model override: missing subject credentials fail
+closed rather than inheriting the server environment.
 
 CRG currently has **no cloud rerank call**: `LOCAL_RERANK_MODEL` is its only
 reranking path. Setting `RERANK_MODELS` or `RERANK_API_BASE` does not enable one.
 
-You can also configure cloud keys interactively in HTTP mode via the relay
-setup form (`config(action="setup_start")` returns the browser URL). See the
-[modes overview](https://mcp.n24q02m.com/get-started/modes-overview/) and
-[multi-user setup](https://mcp.n24q02m.com/get-started/multi-user/).
-
-### Workspace username (HTTP setup form)
-
-The relay setup form has an optional **workspace username** field. Entering the
-same username always lands you in the same per-`sub` bucket, so your keys and
-graph stay reachable across a re-authorization and across devices, instead of
-being tied to the one-off subject minted for each `/authorize` round-trip.
-Leaving it blank keeps the previous per-authorize behaviour.
-
-Trust boundary: when the form is gated by a *shared* `MCP_RELAY_PASSWORD`, the
-username is a partition key, not a secret -- anyone who knows that password can
-type any username and reach that bucket. That is fine for a trusted group; an
-untrusted multi-tenant deployment needs a per-user secret or delegated OAuth
-instead.
-
-**One-time migration:** existing users must re-enter their credentials once after
-this change. Nothing is deleted; credentials stored under the old random subject
-are simply no longer addressed.
-
 ## Tools
 
-Seven tools, each grouping related actions to keep the tool surface small.
+Six tools, each grouping related actions to keep the tool surface small.
 
 ### `graph` -- Graph lifecycle
 
@@ -378,11 +351,11 @@ Actions: `status` | `set` | `cache_clear` | `setup_status` | `setup_start` | `se
 | `status` | Server info: version, graph path, node/edge counts, embedding backend, embeddings count. |
 | `set` | Update a runtime setting (`key=log_level`). |
 | `cache_clear` | Remove all computed embeddings. |
-| `setup_status` | Show current credential state, providers configured, and setup URL. |
-| `setup_start` | Start relay setup to configure API keys via browser (HTTP mode). |
-| `setup_skip` | Set local mode (skip relay permanently, use ONNX only). |
-| `setup_reset` | Clear credentials and reset state. |
-| `setup_complete` | Re-resolve credentials from environment variables. |
+| `setup_status` | Show current credential state and which model cells have keys. |
+| `setup_start` | Explain where the host configures API keys (host-owned model cells). |
+| `setup_skip` | Set local mode (local ONNX embedding, no cloud cells). |
+| `setup_reset` | Reset state to local; host config re-resolves on next call. |
+| `setup_complete` | Re-resolve credential state from host config. |
 
 ### `security` -- Security scanning
 
@@ -405,13 +378,6 @@ Topics: `graph` | `query` | `review` | `config` | `security` | `recipes`
 Returns complete documentation for each tool. Use when the compressed
 descriptions above are insufficient.
 
-### `config__open_relay` -- Re-trigger the relay setup form
-
-Registered automatically from [mcp-core](https://github.com/n24q02m/mcp-core).
-In HTTP mode it returns `<PUBLIC_URL>/authorize` so the agent can re-open the
-browser setup form (e.g. after credential expiry); in stdio mode it returns
-`status: 'stdio_unsupported'`.
-
 ## CLI
 
 The package installs two console scripts: **`crg`** (primary) and
@@ -451,12 +417,8 @@ crg security scan --engine heuristic
 | `query spot_check` / `query renamed_in_diff` / `query diff` | Inspect callsites, line shifts, or commit-to-commit graph changes. |
 | `review context` / `review delta` | Generate review context or diff buckets for a code change. |
 | `security scan` / `security report` / `security suppress` / `security rule_list` | Run and manage heuristic/Semgrep security findings. |
-| `config status` / `config delete` | Show or remove stored credential config (`--yes` skips confirmation). |
-| `doctor` | Environment self-check from shared `mcp-core` CLI. |
-| `relay status` / `relay open` / `relay reset` | Inspect, open, or clear the relay setup session. |
 
-CLI subcommands print structured JSON and exit non-zero on an error. The
-`config`, `doctor`, and `relay` subcommands come from shared `mcp-core`.
+CLI subcommands print structured JSON and exit non-zero on an error.
 
 
 ## Features
@@ -469,7 +431,7 @@ What this fork fixes versus the upstream [code-review-graph](https://github.com/
 | callers_of/callees_of | Empty results (bare name targets) | Qualified name resolution + bare fallback |
 | Embedding | sentence-transformers + torch (1.1 GB) | fastretrieval ONNX + cloud (200 MB), dual-mode |
 | Output size | Unbounded (500K+ chars) | Paginated (max_results, truncated flag) |
-| Tool design | 9 individual tools | 7 grouped tools: graph + query + review + config + security + help + config__open_relay |
+| Tool design | 9 individual tools | 6 grouped tools: graph + query + review + config + security + help |
 | Plugin hooks | Invalid PostEdit/PostGit | Valid PostToolUse |
 
 ## Comparison

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/README.md

@@ -211,9 +211,6 @@ another provider. Summarizers require a chat-completion model.
 | `openrouter/` | `OPENROUTER_API_KEY` | <https://openrouter.ai/settings/keys> |
 | `vertex_express/` | `GOOGLE_VERTEX_EXPRESS_API_KEY` | <https://cloud.google.com/vertex-ai/generative-ai/docs/start/express-mode/overview> |
 
-Any other [litellm provider](https://docs.litellm.ai/docs/providers) works via
-its standard `<PROVIDER>_API_KEY`.
-
 ### Advanced
 
 | Variable | Purpose |
@@ -264,39 +261,15 @@ not invoke the reranker.
 
 Cohere embedding is paid. Authorize a bounded budget before a live index/query;
 the Minimax-free completion choice does not make embeddings free. This example
-does not add a process-wide model override: in remote mode each authenticated
-subject's relay record supplies its models, endpoints and keys. Missing subject
-credentials fail closed rather than inheriting the server environment.
+does not add a process-wide model override: missing subject credentials fail
+closed rather than inheriting the server environment.
 
 CRG currently has **no cloud rerank call**: `LOCAL_RERANK_MODEL` is its only
 reranking path. Setting `RERANK_MODELS` or `RERANK_API_BASE` does not enable one.
 
-You can also configure cloud keys interactively in HTTP mode via the relay
-setup form (`config(action="setup_start")` returns the browser URL). See the
-[modes overview](https://mcp.n24q02m.com/get-started/modes-overview/) and
-[multi-user setup](https://mcp.n24q02m.com/get-started/multi-user/).
-
-### Workspace username (HTTP setup form)
-
-The relay setup form has an optional **workspace username** field. Entering the
-same username always lands you in the same per-`sub` bucket, so your keys and
-graph stay reachable across a re-authorization and across devices, instead of
-being tied to the one-off subject minted for each `/authorize` round-trip.
-Leaving it blank keeps the previous per-authorize behaviour.
-
-Trust boundary: when the form is gated by a *shared* `MCP_RELAY_PASSWORD`, the
-username is a partition key, not a secret -- anyone who knows that password can
-type any username and reach that bucket. That is fine for a trusted group; an
-untrusted multi-tenant deployment needs a per-user secret or delegated OAuth
-instead.
-
-**One-time migration:** existing users must re-enter their credentials once after
-this change. Nothing is deleted; credentials stored under the old random subject
-are simply no longer addressed.
-
 ## Tools
 
-Seven tools, each grouping related actions to keep the tool surface small.
+Six tools, each grouping related actions to keep the tool surface small.
 
 ### `graph` -- Graph lifecycle
 
@@ -346,11 +319,11 @@ Actions: `status` | `set` | `cache_clear` | `setup_status` | `setup_start` | `se
 | `status` | Server info: version, graph path, node/edge counts, embedding backend, embeddings count. |
 | `set` | Update a runtime setting (`key=log_level`). |
 | `cache_clear` | Remove all computed embeddings. |
-| `setup_status` | Show current credential state, providers configured, and setup URL. |
-| `setup_start` | Start relay setup to configure API keys via browser (HTTP mode). |
-| `setup_skip` | Set local mode (skip relay permanently, use ONNX only). |
-| `setup_reset` | Clear credentials and reset state. |
-| `setup_complete` | Re-resolve credentials from environment variables. |
+| `setup_status` | Show current credential state and which model cells have keys. |
+| `setup_start` | Explain where the host configures API keys (host-owned model cells). |
+| `setup_skip` | Set local mode (local ONNX embedding, no cloud cells). |
+| `setup_reset` | Reset state to local; host config re-resolves on next call. |
+| `setup_complete` | Re-resolve credential state from host config. |
 
 ### `security` -- Security scanning
 
@@ -373,13 +346,6 @@ Topics: `graph` | `query` | `review` | `config` | `security` | `recipes`
 Returns complete documentation for each tool. Use when the compressed
 descriptions above are insufficient.
 
-### `config__open_relay` -- Re-trigger the relay setup form
-
-Registered automatically from [mcp-core](https://github.com/n24q02m/mcp-core).
-In HTTP mode it returns `<PUBLIC_URL>/authorize` so the agent can re-open the
-browser setup form (e.g. after credential expiry); in stdio mode it returns
-`status: 'stdio_unsupported'`.
-
 ## CLI
 
 The package installs two console scripts: **`crg`** (primary) and
@@ -419,12 +385,8 @@ crg security scan --engine heuristic
 | `query spot_check` / `query renamed_in_diff` / `query diff` | Inspect callsites, line shifts, or commit-to-commit graph changes. |
 | `review context` / `review delta` | Generate review context or diff buckets for a code change. |
 | `security scan` / `security report` / `security suppress` / `security rule_list` | Run and manage heuristic/Semgrep security findings. |
-| `config status` / `config delete` | Show or remove stored credential config (`--yes` skips confirmation). |
-| `doctor` | Environment self-check from shared `mcp-core` CLI. |
-| `relay status` / `relay open` / `relay reset` | Inspect, open, or clear the relay setup session. |
 
-CLI subcommands print structured JSON and exit non-zero on an error. The
-`config`, `doctor`, and `relay` subcommands come from shared `mcp-core`.
+CLI subcommands print structured JSON and exit non-zero on an error.
 
 
 ## Features
@@ -437,7 +399,7 @@ What this fork fixes versus the upstream [code-review-graph](https://github.com/
 | callers_of/callees_of | Empty results (bare name targets) | Qualified name resolution + bare fallback |
 | Embedding | sentence-transformers + torch (1.1 GB) | fastretrieval ONNX + cloud (200 MB), dual-mode |
 | Output size | Unbounded (500K+ chars) | Paginated (max_results, truncated flag) |
-| Tool design | 9 individual tools | 7 grouped tools: graph + query + review + config + security + help + config__open_relay |
+| Tool design | 9 individual tools | 6 grouped tools: graph + query + review + config + security + help |
 | Plugin hooks | Invalid PostEdit/PostGit | Valid PostToolUse |
 
 ## Comparison

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "better-code-review-graph"
-version = "3.27.0"
+version = "3.27.2"
 description = "Token-efficient code review knowledge graph: semantic search and call-graph resolution."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = "Apache-2.0"
@@ -38,7 +38,7 @@ dependencies = [
 ]
 
 [tool.uv.sources]
-hull-core = { git = "https://github.com/n24q02m/hull", subdirectory = "packages/core-py", rev = "5262d54f4f0c1214dcedaef20531da98f9519bdf" }
+hull-core = { git = "https://github.com/n24q02m/hull", subdirectory = "packages/core-py", rev = "14841d05488c801d303b0f3d3cd97426f94a6e1a" }
 
 [project.scripts]
 better-code-review-graph = "better_code_review_graph.cli:main"

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/n24q02m/crg.git",
     "source": "github"
   },
-  "version": "3.27.0",
+  "version": "3.27.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "better-code-review-graph",
-      "version": "3.27.0",
+      "version": "3.27.2",
       "runtimeHint": "uvx",
       "runtimeArgs": [
         "--python",
@@ -100,7 +100,7 @@
           "name": "LLM_API_BASE"
         },
         {
-          "description": "DEPRECATED (honored one release): single summarizer model as a litellm 'provider/model' string. Use SUMMARY_MODELS instead.",
+          "description": "DEPRECATED (honored one release): single summarizer model string. Use SUMMARY_MODELS instead.",
           "isRequired": false,
           "isSecret": false,
           "name": "SUMMARY_MODEL"

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/src/better_code_review_graph/docs/config.md

@@ -78,8 +78,11 @@ Remove all computed embeddings from the graph database. After clearing, run `gra
 
 ## Setup Actions
 
+Setup actions manage host-owned model cells — there is no browser or relay
+flow; the host owns all credential material.
+
 ### setup_status
-Show current credential state and relay setup URL (if any).
+Show current credential state and which model cells have keys.
 
 **Example:**
 ```json
@@ -89,7 +92,7 @@ Show current credential state and relay setup URL (if any).
 ---
 
 ### setup_start
-Start relay setup session to configure API keys via browser.
+Explain where the host configures API keys.
 
 **Parameters:**
 - `force`: If true, reconfigure even when already configured (default: false)
@@ -102,7 +105,7 @@ Start relay setup session to configure API keys via browser.
 ---
 
 ### setup_skip
-Set local mode permanently — relay will not trigger on next restart.
+Set local mode — local ONNX embedding, no cloud cells.
 
 **Example:**
 ```json
@@ -112,7 +115,7 @@ Set local mode permanently — relay will not trigger on next restart.
 ---
 
 ### setup_reset
-Clear saved credentials and reset to awaiting_setup state.
+Reset state to local; the host config re-resolves on next call.
 
 **Example:**
 ```json
@@ -122,7 +125,7 @@ Clear saved credentials and reset to awaiting_setup state.
 ---
 
 ### setup_complete
-Re-resolve credentials from current environment variables (picks up manually set API keys).
+Re-resolve credential state from the host configuration.
 
 **Example:**
 ```json

{better_code_review_graph-3.27.0 → better_code_review_graph-3.27.2}/src/better_code_review_graph/server.py

@@ -163,10 +163,10 @@ mcp = FastMCP(
     version=_pkg_version,
     instructions=(
         "Persistent incremental knowledge graph for token-efficient, "
-        "context-aware code reviews. 7 tools: graph (build/embed/stats), "
+        "context-aware code reviews. 6 tools: graph (build/embed/stats), "
         "query (search/impact/patterns), review (code review context), "
         "config (status/set/setup_*), security (scan/report/rule_list), "
-        "help (full docs), config__open_relay (re-trigger relay form)."
+        "help (full docs)."
     ),
 )