better-code-review-graph 3.27.2__tar.gz → 3.28.0__tar.gz

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "better-code-review-graph",
   "description": "Knowledge graph for token-efficient code reviews -- semantic search and call-graph resolution across your codebase.",
-  "version": "3.27.2",
+  "version": "3.28.0",
   "userConfig": {
     "EMBEDDING_MODELS": {
       "type": "string",

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 <!-- version list -->
 
+## v3.28.0 (2026-09-27)
+
+### Code Style
+
+- Apply ruff format repo-wide (de-host format debt)
+  ([`de1a18f`](https://github.com/n24q02m/crg/commit/de1a18f0dcfa46bc53ce37e8f15898a927de16f6))
+
+- Fix ruff F401/I001 left by residuals scrub
+  ([`194ce5f`](https://github.com/n24q02m/crg/commit/194ce5f2298b0be9d3e67435c5cbdaa5d23ee5c8))
+
+### Features
+
+- Add host control-plane CLI (server start, token hash, config, db path)
+  ([#1101](https://github.com/n24q02m/crg/pull/1101),
+  [`ab10fb5`](https://github.com/n24q02m/crg/commit/ab10fb535c74b88d769d9ff94f654a127dd7cf36))
+
+### Testing
+
+- **wp2**: Add token-auth HTTP MCP e2e + per-sub storage/auth coverage
+  ([#1100](https://github.com/n24q02m/crg/pull/1100),
+  [`11cf315`](https://github.com/n24q02m/crg/commit/11cf3159af5ef90e133091344e12ad7d95eb4091))
+
+
+## v3.27.3 (2026-09-26)
+
+### Bug Fixes
+
+- **deps**: Lock file maintenance ([#1097](https://github.com/n24q02m/crg/pull/1097),
+  [`89ff192`](https://github.com/n24q02m/crg/commit/89ff1928bd90f8834456a59d184a6eb25e3c4936))
+
+- **deps**: Update fastretrieval to >=1.11.1,<2 ([#1096](https://github.com/n24q02m/crg/pull/1096),
+  [`58b1559`](https://github.com/n24q02m/crg/commit/58b1559028cb323104c83b77e95560eb5c5c3c78))
+
+
 ## v3.27.2 (2026-09-26)
 
 ### Bug Fixes

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: better-code-review-graph
-Version: 3.27.2
+Version: 3.28.0
 Summary: Token-efficient code review knowledge graph: semantic search and call-graph resolution.
 Author: n24q02m
 License-Expression: Apache-2.0
@@ -16,7 +16,7 @@ Requires-Python: ==3.13.*
 Requires-Dist: alembic<2,>=1.20.0
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: fastmcp<4,>=3.4.7
-Requires-Dist: fastretrieval<2,>=1.8.2
+Requires-Dist: fastretrieval<2,>=1.11.1
 Requires-Dist: httpx
 Requires-Dist: hull-core
 Requires-Dist: mcp<2,>=1.30.0

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "better-code-review-graph"
-version = "3.27.2"
+version = "3.28.0"
 description = "Token-efficient code review knowledge graph: semantic search and call-graph resolution."
 readme = { file = "README.md", content-type = "text/markdown" }
 license = "Apache-2.0"
@@ -24,7 +24,7 @@ dependencies = [
     "tree-sitter-language-pack>=1.20.0,<2",
     "networkx>=3.7,<4",
     "watchdog>=6.0.0,<7",
-    "fastretrieval>=1.8.2,<2",
+    "fastretrieval>=1.11.1,<2",
     "httpx",
     "pydantic-settings",
     # De-hosted shared core (WP1): token auth (3 modes), per-task model cells

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/n24q02m/crg.git",
     "source": "github"
   },
-  "version": "3.27.2",
+  "version": "3.28.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "better-code-review-graph",
-      "version": "3.27.2",
+      "version": "3.28.0",
       "runtimeHint": "uvx",
       "runtimeArgs": [
         "--python",

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/src/better_code_review_graph/cli.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import os
 from importlib.metadata import PackageNotFoundError
 from importlib.metadata import version as pkg_version
 from typing import Any
@@ -513,6 +514,148 @@ def _handle_security(args: argparse.Namespace) -> int:
     return _print_result(result)
 
 
+# ---------------------------------------------------------------------------
+# Host control plane (hull-core pattern): server/token/config/db
+# ---------------------------------------------------------------------------
+
+
+def _configure_server(sub: argparse.ArgumentParser) -> None:
+    server_sub = sub.add_subparsers(dest="server_command", required=True)
+    start = server_sub.add_parser(
+        "start", help="start the HTTP MCP server (blocking; Ctrl+C stops)"
+    )
+    start.add_argument("--host", default=None, help="bind host (default from config)")
+    start.add_argument(
+        "--port", type=int, default=None, help="bind port (default from config)"
+    )
+
+
+def _handle_server_start(args: argparse.Namespace) -> int:
+    import sys
+
+    from .config import load_instance_settings
+    from .server import serve_main
+
+    os.environ["MCP_TRANSPORT"] = "http"
+    # run_http() resolves bind address from these (falls back to config).
+    host = args.host or os.environ.get("MCP_HOST")
+    if args.host:
+        os.environ["MCP_HOST"] = args.host
+    if args.port:
+        os.environ["MCP_PORT"] = str(args.port)
+    # Security property carried over from the wp2-wip line: an
+    # unauthenticated (no-auth) listener must never bind off-loopback.
+    if (
+        host
+        and host not in {"localhost", "127.0.0.1", "::1"}
+        and load_instance_settings().server.auth == "no-auth"
+    ):
+        print(
+            "crg refuses to start: auth = 'no-auth' only permits loopback "
+            "binds; set [server] auth to 'token' or 'multi' for a shared "
+            "listener",
+            file=sys.stderr,
+        )
+        return 2
+    try:
+        serve_main()
+    except KeyboardInterrupt:
+        pass
+    except SystemExit as exc:  # e.g. no-auth non-loopback bind refusal
+        if str(exc):
+            print(f"error: {exc}", file=sys.stderr)
+        return 2
+    return 0
+
+
+def _configure_token(sub: argparse.ArgumentParser) -> None:
+    token_sub = sub.add_subparsers(dest="token_command", required=True)
+    token_hash_p = token_sub.add_parser(
+        "hash", help="mint a scrypt token_hash from a plaintext token"
+    )
+    token_hash_p.add_argument(
+        "token", help="plaintext token (keep it out of shell history)"
+    )
+
+
+def _handle_token_hash(args: argparse.Namespace) -> int:
+    from hull_core.auth.tokens import hash_token
+
+    print(hash_token(args.token))
+    return 0
+
+
+def _configure_config(sub: argparse.ArgumentParser) -> None:
+    config_sub = sub.add_subparsers(dest="config_command", required=True)
+    init_p = config_sub.add_parser(
+        "init", help="write the instance config.toml from the template"
+    )
+    init_p.add_argument(
+        "--force", action="store_true", help="overwrite an existing config"
+    )
+    config_sub.add_parser("path", help="print the config file path")
+    config_sub.add_parser(
+        "show", help="print the effective config (template if absent)"
+    )
+
+
+def _handle_config_init(args: argparse.Namespace) -> int:
+    import sys
+
+    from hull_core.config.settings import write_default_config
+
+    from .config import crg_config_dir
+
+    try:
+        path = write_default_config(config_dir=crg_config_dir(), force=args.force)
+    except FileExistsError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+    print(f"wrote {path}")
+    return 0
+
+
+def _handle_config_path(_args: argparse.Namespace) -> int:
+    from .config import crg_config_dir
+
+    print(crg_config_dir() / "config.toml")
+    return 0
+
+
+def _handle_config_show(_args: argparse.Namespace) -> int:
+
+    from hull_core.config.settings import CONFIG_TEMPLATE
+
+    from .config import crg_config_dir
+
+    path = crg_config_dir() / "config.toml"
+    if path.is_file():
+        print(path.read_text(encoding="utf-8"), end="")
+    else:
+        print(CONFIG_TEMPLATE, end="")
+    return 0
+
+
+def _configure_db(sub: argparse.ArgumentParser) -> None:
+    db_sub = sub.add_subparsers(dest="db_command", required=True)
+    db_sub.add_parser("path", help="print the repo-local graph.db path")
+
+
+def _handle_db_path(_args: argparse.Namespace) -> int:
+    from .incremental import find_project_root, get_db_path
+
+    print(get_db_path(find_project_root(None)))
+    return 0
+
+
+def _handle_config(args: argparse.Namespace) -> int:
+    if args.config_command == "path":
+        return _handle_config_path(args)
+    if args.config_command == "show":
+        return _handle_config_show(args)
+    return _handle_config_init(args)
+
+
 # ---------------------------------------------------------------------------
 # Main entrypoint
 # ---------------------------------------------------------------------------
@@ -533,6 +676,10 @@ def main() -> int:
         "query": (_configure_query, _handle_query),
         "review": (_configure_review, _handle_review),
         "security": (_configure_security, _handle_security),
+        "server": (_configure_server, _handle_server_start),
+        "token": (_configure_token, _handle_token_hash),
+        "config": (_configure_config, _handle_config),
+        "db": (_configure_db, _handle_db_path),
     }
 
     argv = sys.argv[1:]
@@ -546,7 +693,9 @@ def main() -> int:
     if argv[0] in ("-h", "--help"):
         names = ", ".join(sorted(handlers))
         print("usage: better-code-review-graph [-h] [--version] [<subcommand> ...]")
-        print("Any other flags/args are passed through to the MCP server (e.g. --http).")
+        print(
+            "Any other flags/args are passed through to the MCP server (e.g. --http)."
+        )
         print(f"subcommands: {names}")
         return 0
     if argv[0] in ("--version", "-V"):

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/src/better_code_review_graph/server.py

@@ -990,7 +990,11 @@ async def run_http(port: int = 0) -> None:
     if host is None:
         host = settings.server.host
 
-    users = load_users(settings.server.users_file) if settings.server.auth == "multi" else None
+    users = (
+        load_users(settings.server.users_file)
+        if settings.server.auth == "multi"
+        else None
+    )
     authenticator = Authenticator(settings, users=users, limiter=SlidingWindowLimiter())
     app = mcp.http_app(
         path="/mcp",

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/tests/integration/test_multi_user_remote.py

@@ -58,12 +58,10 @@ def test_sub_stores_do_not_see_each_others_nodes(tmp_path, monkeypatch):
         _build(store_b, "bob")
 
         names_a = {
-            row["name"]
-            for row in store_a._conn.execute("SELECT name FROM nodes")
+            row["name"] for row in store_a._conn.execute("SELECT name FROM nodes")
         }
         names_b = {
-            row["name"]
-            for row in store_b._conn.execute("SELECT name FROM nodes")
+            row["name"] for row in store_b._conn.execute("SELECT name FROM nodes")
         }
         assert names_a == {"alice_fn"}
         assert names_b == {"bob_fn"}

better_code_review_graph-3.28.0/tests/test_cli_control_plane.py

@@ -0,0 +1,131 @@
+"""Host control-plane CLI: server/token/config/db subcommands (WP2 lifecycle).
+
+Fast, hermetic coverage of the operator surface — the server path is tested
+end-to-end (spawn + bearer + build/query) in tests/test_http_mcp_e2e.py; here
+we pin the dispatch contract and the env handoff to run_http().
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+from better_code_review_graph.cli import main
+
+
+def _run(capsys, *argv: str) -> int:
+    sys.argv = ["better-code-review-graph", *argv]
+    return main()
+
+
+def test_token_hash_matches_hull_primitive(capsys) -> None:
+    from hull_core.auth.tokens import verify_token
+
+    rc = _run(capsys, "token", "hash", "s3cret-token")
+    out = capsys.readouterr().out.strip()
+    assert rc == 0
+    # scrypt hashes are salted per call: verify rather than compare.
+    assert verify_token("s3cret-token", out)
+    assert not verify_token("wrong-token", out)
+    rc2 = _run(capsys, "token", "hash", "s3cret-token")
+    out2 = capsys.readouterr().out.strip()
+    assert rc2 == 0
+    assert out2 != out  # fresh salt per mint
+
+
+def test_config_path_prints_instance_config(capsys, tmp_path, monkeypatch) -> None:
+    monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path))
+    rc = _run(capsys, "config", "path")
+    out = capsys.readouterr().out.strip()
+    assert rc == 0
+    assert out == str(Path(tmp_path) / "config.toml")
+
+
+def test_config_init_writes_then_refuses_without_force(
+    capsys, tmp_path, monkeypatch
+) -> None:
+    monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path))
+    rc = _run(capsys, "config", "init")
+    assert rc == 0
+    assert (Path(tmp_path) / "config.toml").is_file()
+
+    rc = _run(capsys, "config", "init")
+    err = capsys.readouterr().err
+    assert rc == 2
+    assert "error" in err
+
+    rc = _run(capsys, "config", "init", "--force")
+    assert rc == 0
+
+
+def test_config_show_prints_template_when_absent(capsys, tmp_path, monkeypatch) -> None:
+    monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path / "missing"))
+    rc = _run(capsys, "config", "show")
+    out = capsys.readouterr().out
+    assert rc == 0
+    assert "[server]" in out  # template content
+
+
+def test_db_path_prints_graph_db(capsys) -> None:
+    rc = _run(capsys, "db", "path")
+    out = capsys.readouterr().out.strip()
+    assert rc == 0
+    assert out.endswith("graph.db")
+
+
+def test_server_start_forces_http_transport(capsys, monkeypatch) -> None:
+    monkeypatch.delenv("MCP_TRANSPORT", raising=False)
+    monkeypatch.delenv("MCP_HOST", raising=False)
+    monkeypatch.delenv("MCP_PORT", raising=False)
+    seen: dict[str, object] = {}
+
+    def fake_serve_main() -> None:
+        seen["transport"] = __import__("os").environ.get("MCP_TRANSPORT")
+        seen["host"] = __import__("os").environ.get("MCP_HOST")
+        seen["port"] = __import__("os").environ.get("MCP_PORT")
+
+    monkeypatch.setattr("better_code_review_graph.server.serve_main", fake_serve_main)
+
+    rc = _run(capsys, "server", "start", "--host", "127.0.0.1", "--port", "60077")
+    assert rc == 0
+    assert seen == {"transport": "http", "host": "127.0.0.1", "port": "60077"}
+
+
+def test_server_start_keyboard_interrupt_is_clean(capsys, monkeypatch) -> None:
+    def interrupted() -> None:
+        raise KeyboardInterrupt
+
+    monkeypatch.setattr("better_code_review_graph.server.serve_main", interrupted)
+    rc = _run(capsys, "server", "start")
+    assert rc == 0
+
+
+def test_server_start_refuses_no_auth_off_loopback(
+    capsys, tmp_path, monkeypatch
+) -> None:
+    cfg = tmp_path / "cfg"
+    cfg.mkdir()
+    (cfg / "config.toml").write_text(
+        '[server]\nhost = "127.0.0.1"\nport = 61000\nauth = "no-auth"\n'
+    )
+    monkeypatch.setenv("CRG_CONFIG_DIR", str(cfg))
+    monkeypatch.delenv("MCP_TRANSPORT", raising=False)
+    serve_called = False
+
+    def must_not_serve() -> None:
+        nonlocal serve_called  # noqa: F841
+        serve_called = True  # pragma: no cover
+
+    monkeypatch.setattr("better_code_review_graph.server.serve_main", must_not_serve)
+    rc = _run(capsys, "server", "start", "--host", "0.0.0.0")
+    err = capsys.readouterr().err
+    assert rc == 2
+    assert "no-auth" in err and "loopback" in err
+    assert serve_called is False
+
+
+def test_unknown_subcommand_is_rc2(capsys) -> None:
+    rc = _run(capsys, "nope")
+    err = capsys.readouterr().err
+    assert rc == 2
+    assert "unknown subcommand" in err

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/tests/test_cohere_dimensions.py

@@ -10,7 +10,6 @@ are unchanged.
 
 from __future__ import annotations
 
-import os
 import sqlite3
 from unittest.mock import patch
 
@@ -44,9 +43,7 @@ def _dispatch(*vectors):
 def test_unsupported_cohere_width_is_rejected_without_dispatch():
     # The width-selection guard lives inside _post_embeddings and must fire
     # BEFORE any client is constructed / request is spent.
-    with patch(
-        "hull_core.providers.openai_spec.OpenAICompatClient"
-    ) as client_cls:
+    with patch("hull_core.providers.openai_spec.OpenAICompatClient") as client_cls:
         with pytest.raises(ValueError, match="requires dimensions"):
             _post_embeddings(
                 ["hello"],
@@ -152,9 +149,7 @@ def test_cohere_reopen_reembed_legacy_width_and_query(tmp_path):
                 assert [
                     call.kwargs["input_type"] for call in dispatch.call_args_list
                 ] == ["search_document", "search_query"]
-                assert all(
-                    call.args[2] == 1024 for call in dispatch.call_args_list
-                )
+                assert all(call.args[2] == 1024 for call in dispatch.call_args_list)
         finally:
             store.close()
         with sqlite3.connect(db) as conn:

better_code_review_graph-3.28.0/tests/test_credential_state.py

@@ -0,0 +1,164 @@
+"""Tests for credential_state -- hull-core identity scoping + cell state.
+
+WP2 de-host: there is no credential store, no relay, and no per-user key
+bucket. What remains is (a) the host-level CONFIGURED/LOCAL cell state,
+(b) the per-request subject contextvar with hull ``multi``-mode fallback,
+and (c) the ``subs/<namespace>/graph.db`` path helpers.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+import better_code_review_graph.credential_state as cs
+from better_code_review_graph.credential_state import (
+    SERVER_NAME,
+    CredentialState,
+    get_current_sub,
+    get_state,
+    resolve_credential_state,
+    set_current_sub,
+    set_state,
+)
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture(autouse=True)
+def _reset_module_state():
+    """Reset module-level state before and after each test."""
+    set_current_sub(None)
+    set_state(CredentialState.LOCAL)
+    yield
+    set_current_sub(None)
+    set_state(CredentialState.LOCAL)
+
+
+def _write_config(tmp_path, body: str):
+    tmp_path.mkdir(parents=True, exist_ok=True)
+    (tmp_path / "config.toml").write_text(body, encoding="utf-8")
+    return tmp_path
+
+
+# ---------------------------------------------------------------------------
+# Constants
+# ---------------------------------------------------------------------------
+
+
+class TestConstants:
+    def test_server_name(self):
+        assert SERVER_NAME == "better-code-review-graph"
+
+    def test_credential_state_enum_values(self):
+        assert CredentialState.CONFIGURED.value == "configured"
+        assert CredentialState.LOCAL.value == "local"
+
+    def test_enum_has_exactly_two_states(self):
+        # No relay-era states may reappear (awaiting_setup / setup_in_progress).
+        assert {member.name for member in CredentialState} == {"CONFIGURED", "LOCAL"}
+
+
+# ---------------------------------------------------------------------------
+# get_state / set_state
+# ---------------------------------------------------------------------------
+
+
+class TestStateAccessors:
+    def test_set_state_changes_state(self):
+        set_state(CredentialState.CONFIGURED)
+        assert get_state() == CredentialState.CONFIGURED
+
+    def test_set_state_to_local(self):
+        set_state(CredentialState.LOCAL)
+        assert get_state() == CredentialState.LOCAL
+
+
+# ---------------------------------------------------------------------------
+# resolve_credential_state (host model cells)
+# ---------------------------------------------------------------------------
+
+
+class TestResolveCredentialState:
+    def test_no_config_is_local(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path / "absent"))
+        assert resolve_credential_state() == CredentialState.LOCAL
+        assert get_state() == CredentialState.LOCAL
+
+    def test_chat_cell_key_sets_configured(self, tmp_path, monkeypatch):
+        _write_config(
+            tmp_path,
+            '[models.chat]\nbase_url = "https://openrouter.ai/api/v1"\napi_key = "sk-h"\nmodel = "m"\n',
+        )
+        monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path))
+        assert resolve_credential_state() == CredentialState.CONFIGURED
+
+    def test_embed_cell_env_key_sets_configured(self, tmp_path, monkeypatch):
+        monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path))
+        monkeypatch.setenv("HULL_EMBED_API_KEY", "sk-e")
+        try:
+            assert resolve_credential_state() == CredentialState.CONFIGURED
+        finally:
+            monkeypatch.delenv("HULL_EMBED_API_KEY")
+
+    def test_cell_without_key_stays_local(self, tmp_path, monkeypatch):
+        _write_config(
+            tmp_path,
+            '[models.embed]\nbase_url = "https://openrouter.ai/api/v1"\napi_key = ""\nmodel = "voyage-4-lite"\n',
+        )
+        monkeypatch.setenv("CRG_CONFIG_DIR", str(tmp_path))
+        assert resolve_credential_state() == CredentialState.LOCAL
+
+
+# ---------------------------------------------------------------------------
+# Credential isolation regression guard
+# ---------------------------------------------------------------------------
+
+
+class TestCredentialIsolation:
+    """better-code-review-graph must not write to peer MCP servers' configs."""
+
+    def test_no_peer_key_sharing_helper(self):
+        assert not hasattr(cs, "_share_cloud_keys_to_peers")
+
+
+class TestCutSurfaceAbsent:
+    """The relay/BYOK surface must not reappear after the de-host."""
+
+    @pytest.mark.parametrize(
+        "symbol",
+        [
+            "CLOUD_KEYS",
+            "credentials_for_current_request",
+            "config_value_for_current_request",
+            "save_credentials",
+            "store_for_sub",
+            "read_for_sub",
+            "get_setup_url",
+            "reset_state",
+            "load_credentials",
+            "clear_credentials",
+        ],
+    )
+    def test_symbol_removed(self, symbol):
+        assert not hasattr(cs, symbol)
+
+
+# ---------------------------------------------------------------------------
+# Current subject
+# ---------------------------------------------------------------------------
+
+
+class TestCurrentSub:
+    def test_default_is_none(self):
+        assert get_current_sub() is None
+
+    def test_set_current_sub_roundtrip(self):
+        set_current_sub("user-a")
+        assert get_current_sub() == "user-a"
+
+    def test_clearing_restores_none(self):
+        set_current_sub("user-a")
+        set_current_sub(None)
+        assert get_current_sub() is None

{better_code_review_graph-3.27.2 → better_code_review_graph-3.28.0}/tests/test_embeddings.py

@@ -167,7 +167,9 @@ class TestResolveBackend:
         """
         import logging
 
-        with caplog.at_level(logging.WARNING, logger="better_code_review_graph.embeddings"):
+        with caplog.at_level(
+            logging.WARNING, logger="better_code_review_graph.embeddings"
+        ):
             with patch.dict(os.environ, {"EMBEDDING_BACKEND": "cloud"}, clear=True):
                 assert resolve_backend() == "local"
             with patch.dict(os.environ, {"EMBEDDING_BACKEND": "litellm"}, clear=True):
@@ -340,7 +342,9 @@ class TestResolveEmbeddingChain:
             "CO_API_KEY",
         ):
             monkeypatch.delenv(k, raising=False)
-        with caplog.at_level(logging.WARNING, logger="better_code_review_graph.embeddings"):
+        with caplog.at_level(
+            logging.WARNING, logger="better_code_review_graph.embeddings"
+        ):
             for legacy in ("cloud", "litellm", "local"):
                 monkeypatch.setenv("EMBEDDING_BACKEND", legacy)
                 assert resolve_backend() == "local"
@@ -610,9 +614,7 @@ class TestCloudEmbeddingBackend:
         with _patched_client(vectors=[]) as client_cls:
             with pytest.raises(ValueError, match="vector count"):
                 backend.embed_texts(["a"])
-        assert client_cls.instances[-1].calls == [
-            {"texts": ["a"], "dimensions": None}
-        ]
+        assert client_cls.instances[-1].calls == [{"texts": ["a"], "dimensions": None}]
 
     def test_width_mismatch_fails_closed(self):
         """Provider width != requested dimensions must fail loudly."""