cg-code-graph 0.19.0__tar.gz → 0.20.0__tar.gz

{cg_code_graph-0.19.0/cg_code_graph.egg-info → cg_code_graph-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cg-code-graph
-Version: 0.19.0
+Version: 0.20.0
 Summary: cg: a code graph of routes, calls, data access and platform boundaries for agents and humans (CLI + MCP server)
 Author: cyberchronos00
 License-Expression: MIT
@@ -33,11 +33,11 @@ Dynamic: license-file
 
 For you and your AI agent (CLI + MCP). No LLM in the graph.
 
-[![PyPI](https://img.shields.io/pypi/v/cg-code-graph)](https://pypi.org/project/cg-code-graph/) [![Downloads](https://img.shields.io/pepy/dt/cg-code-graph)](https://pepy.tech/project/cg-code-graph) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB)](https://pypi.org/project/cg-code-graph/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Docs](https://img.shields.io/badge/docs-code--graph-93b600)](https://code-graph.cyberchronos00.workers.dev/)
+[![PyPI](https://img.shields.io/pypi/v/cg-code-graph)](https://pypi.org/project/cg-code-graph/) [![Downloads](https://img.shields.io/pepy/dt/cg-code-graph)](https://pepy.tech/project/cg-code-graph) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB)](https://pypi.org/project/cg-code-graph/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE) [![Docs](https://img.shields.io/badge/docs-code--graph-93b600)](https://code-graph.cyberchronos00.workers.dev/)
 
-[Docs](https://code-graph.cyberchronos00.workers.dev/) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Changelog](CHANGELOG.md)
+[Docs](https://code-graph.cyberchronos00.workers.dev/) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Changelog](https://github.com/cyberchronos00/code-graph/blob/main/CHANGELOG.md)
 
-[![cg visual view: the graph around the warehouse connection, a selected node with its evidence paths and source, then the planned-change overlay for the preorders plan](docs/media/cg-view-preview.gif)](docs/media/cg-view-demo.mp4)
+[![cg visual view: the graph around the warehouse connection, a selected node with its evidence paths and source, then the planned-change overlay for the preorders plan](https://raw.githubusercontent.com/cyberchronos00/code-graph/main/docs/media/cg-view-preview.gif)](https://github.com/cyberchronos00/code-graph/blob/main/docs/media/cg-view-demo.mp4)
 
 </div>
 
@@ -67,7 +67,7 @@ dependents: 18 nodes  (code: 6, entry points: 9, other: 3)
           -READS_TABLE[resolved @ catalog/tasks.py:14]-> table:store_books
 ```
 
-[![Terminal demo: cg indexes the bundled Laravel and Nuxt sample apps, links them, then runs reaches, path, impact and plan check](docs/media/cg-terminal-demo.gif)](docs/media/cg-terminal-demo.mp4)
+[![Terminal demo: cg indexes the bundled Laravel and Nuxt sample apps, links them, then runs reaches, path, impact and plan check](https://raw.githubusercontent.com/cyberchronos00/code-graph/main/docs/media/cg-terminal-demo.gif)](https://github.com/cyberchronos00/code-graph/blob/main/docs/media/cg-terminal-demo.mp4)
 
 ## Supported languages
 
@@ -75,7 +75,7 @@ dependents: 18 nodes  (code: 6, entry points: 9, other: 3)
 |---|---|---|---|
 | ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) | Django (+ DRF, django-ninja), FastAPI / Starlette, Flask, Celery | exact (stdlib `ast`) | [Python](https://code-graph.cyberchronos00.workers.dev/docs/python) |
 | ![TypeScript](https://img.shields.io/badge/TypeScript-3178C6?logo=typescript&logoColor=white) ![JavaScript](https://img.shields.io/badge/JavaScript-F7DF1E?logo=javascript&logoColor=black) | Nuxt / Vue, NestJS, Next.js, Astro, Express, Fastify, Koa, Hono, Elysia, React Router / Remix | exact (TypeScript compiler API) | [TS frameworks](https://code-graph.cyberchronos00.workers.dev/docs/ts-frameworks) |
-| ![PHP](https://img.shields.io/badge/PHP-777BB4?logo=php&logoColor=white) | Laravel (routes, middleware, queues, broadcasting, outbound HTTP) | exact (nikic/php-parser; needs PHP 8.2+) | [PHP](https://code-graph.cyberchronos00.workers.dev/docs/php) |
+| ![PHP](https://img.shields.io/badge/PHP-777BB4?logo=php&logoColor=white) | Laravel (routes, route attributes, middleware, queues, broadcasting, outbound HTTP) | exact (nikic/php-parser; needs PHP 8.2+) | [PHP](https://code-graph.cyberchronos00.workers.dev/docs/php) |
 | ![Dart](https://img.shields.io/badge/Dart-0175C2?logo=dart&logoColor=white) | Flutter | exact (Dart analyzer; needs the Dart SDK) | [Platforms](https://code-graph.cyberchronos00.workers.dev/docs/platforms) |
 | ![Kotlin](https://img.shields.io/badge/Kotlin-7F52FF?logo=kotlin&logoColor=white) | Android, Kotlin Multiplatform, Spring | heuristic; exact with scip-java (opt-in) | [Kotlin](https://code-graph.cyberchronos00.workers.dev/docs/kotlin) |
 | ![Java](https://img.shields.io/badge/Java-ED8B00?logo=openjdk&logoColor=white) | Spring (routes, guards, beans, tables, clients) | heuristic; exact with scip-java (opt-in) | [Java](https://code-graph.cyberchronos00.workers.dev/docs/java) |
@@ -88,8 +88,8 @@ Go and others: import a SCIP index with `cg index --scip FILE`. Run `cg doctor`
 
 - `reaches`, `impact`, `path`: every caller, route, job and page that reaches a table, config key or method.
 - `cg affected --base main`: the tests and entry points a change reaches (`--quiet` feeds your test runner).
-- Across repos: `cg link` matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes.
-- Route guards: `cg routes --writes --unguarded` lists routes that write with no auth guard.
+- Across repos: `cg link` matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes, and checks request keys (Laravel FormRequest, Elysia schemas, Nuxt / TypeScript bodies).
+- Route guards: `cg routes --writes --unguarded` lists routes that write with no auth guard. Laravel checks inside the action count as inline guards unless `--strict`.
 - MCP server (`cg-mcp`) so agents query the graph instead of grepping.
 - Visual view (`cg serve`) and plan checks (`cg plan check`) for planned changes.
 
@@ -97,6 +97,6 @@ Go and others: import a SCIP index with `cg index --scip FILE`. Run `cg doctor`
 
 [Install](https://code-graph.cyberchronos00.workers.dev/docs/install) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Configuration](https://code-graph.cyberchronos00.workers.dev/docs/configuration) · [Architecture](https://code-graph.cyberchronos00.workers.dev/docs/architecture) · [Limitations](https://code-graph.cyberchronos00.workers.dev/docs/limitations)
 
-[Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md) · MIT [License](LICENSE)
+[Changelog](https://github.com/cyberchronos00/code-graph/blob/main/CHANGELOG.md) · [Contributing](https://github.com/cyberchronos00/code-graph/blob/main/CONTRIBUTING.md) · [Security](https://github.com/cyberchronos00/code-graph/blob/main/SECURITY.md) · MIT [License](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE)
 
-More recordings: [docs/media](docs/media).
+More recordings: [docs/media](https://github.com/cyberchronos00/code-graph/tree/main/docs/media).

{cg_code_graph-0.19.0 → cg_code_graph-0.20.0}/README.md

@@ -6,11 +6,11 @@
 
 For you and your AI agent (CLI + MCP). No LLM in the graph.
 
-[![PyPI](https://img.shields.io/pypi/v/cg-code-graph)](https://pypi.org/project/cg-code-graph/) [![Downloads](https://img.shields.io/pepy/dt/cg-code-graph)](https://pepy.tech/project/cg-code-graph) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB)](https://pypi.org/project/cg-code-graph/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Docs](https://img.shields.io/badge/docs-code--graph-93b600)](https://code-graph.cyberchronos00.workers.dev/)
+[![PyPI](https://img.shields.io/pypi/v/cg-code-graph)](https://pypi.org/project/cg-code-graph/) [![Downloads](https://img.shields.io/pepy/dt/cg-code-graph)](https://pepy.tech/project/cg-code-graph) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB)](https://pypi.org/project/cg-code-graph/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE) [![Docs](https://img.shields.io/badge/docs-code--graph-93b600)](https://code-graph.cyberchronos00.workers.dev/)
 
-[Docs](https://code-graph.cyberchronos00.workers.dev/) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Changelog](CHANGELOG.md)
+[Docs](https://code-graph.cyberchronos00.workers.dev/) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Changelog](https://github.com/cyberchronos00/code-graph/blob/main/CHANGELOG.md)
 
-[![cg visual view: the graph around the warehouse connection, a selected node with its evidence paths and source, then the planned-change overlay for the preorders plan](docs/media/cg-view-preview.gif)](docs/media/cg-view-demo.mp4)
+[![cg visual view: the graph around the warehouse connection, a selected node with its evidence paths and source, then the planned-change overlay for the preorders plan](https://raw.githubusercontent.com/cyberchronos00/code-graph/main/docs/media/cg-view-preview.gif)](https://github.com/cyberchronos00/code-graph/blob/main/docs/media/cg-view-demo.mp4)
 
 </div>
 
@@ -40,7 +40,7 @@ dependents: 18 nodes  (code: 6, entry points: 9, other: 3)
           -READS_TABLE[resolved @ catalog/tasks.py:14]-> table:store_books
 ```
 
-[![Terminal demo: cg indexes the bundled Laravel and Nuxt sample apps, links them, then runs reaches, path, impact and plan check](docs/media/cg-terminal-demo.gif)](docs/media/cg-terminal-demo.mp4)
+[![Terminal demo: cg indexes the bundled Laravel and Nuxt sample apps, links them, then runs reaches, path, impact and plan check](https://raw.githubusercontent.com/cyberchronos00/code-graph/main/docs/media/cg-terminal-demo.gif)](https://github.com/cyberchronos00/code-graph/blob/main/docs/media/cg-terminal-demo.mp4)
 
 ## Supported languages
 
@@ -48,7 +48,7 @@ dependents: 18 nodes  (code: 6, entry points: 9, other: 3)
 |---|---|---|---|
 | ![Python](https://img.shields.io/badge/Python-3776AB?logo=python&logoColor=white) | Django (+ DRF, django-ninja), FastAPI / Starlette, Flask, Celery | exact (stdlib `ast`) | [Python](https://code-graph.cyberchronos00.workers.dev/docs/python) |
 | ![TypeScript](https://img.shields.io/badge/TypeScript-3178C6?logo=typescript&logoColor=white) ![JavaScript](https://img.shields.io/badge/JavaScript-F7DF1E?logo=javascript&logoColor=black) | Nuxt / Vue, NestJS, Next.js, Astro, Express, Fastify, Koa, Hono, Elysia, React Router / Remix | exact (TypeScript compiler API) | [TS frameworks](https://code-graph.cyberchronos00.workers.dev/docs/ts-frameworks) |
-| ![PHP](https://img.shields.io/badge/PHP-777BB4?logo=php&logoColor=white) | Laravel (routes, middleware, queues, broadcasting, outbound HTTP) | exact (nikic/php-parser; needs PHP 8.2+) | [PHP](https://code-graph.cyberchronos00.workers.dev/docs/php) |
+| ![PHP](https://img.shields.io/badge/PHP-777BB4?logo=php&logoColor=white) | Laravel (routes, route attributes, middleware, queues, broadcasting, outbound HTTP) | exact (nikic/php-parser; needs PHP 8.2+) | [PHP](https://code-graph.cyberchronos00.workers.dev/docs/php) |
 | ![Dart](https://img.shields.io/badge/Dart-0175C2?logo=dart&logoColor=white) | Flutter | exact (Dart analyzer; needs the Dart SDK) | [Platforms](https://code-graph.cyberchronos00.workers.dev/docs/platforms) |
 | ![Kotlin](https://img.shields.io/badge/Kotlin-7F52FF?logo=kotlin&logoColor=white) | Android, Kotlin Multiplatform, Spring | heuristic; exact with scip-java (opt-in) | [Kotlin](https://code-graph.cyberchronos00.workers.dev/docs/kotlin) |
 | ![Java](https://img.shields.io/badge/Java-ED8B00?logo=openjdk&logoColor=white) | Spring (routes, guards, beans, tables, clients) | heuristic; exact with scip-java (opt-in) | [Java](https://code-graph.cyberchronos00.workers.dev/docs/java) |
@@ -61,8 +61,8 @@ Go and others: import a SCIP index with `cg index --scip FILE`. Run `cg doctor`
 
 - `reaches`, `impact`, `path`: every caller, route, job and page that reaches a table, config key or method.
 - `cg affected --base main`: the tests and entry points a change reaches (`--quiet` feeds your test runner).
-- Across repos: `cg link` matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes.
-- Route guards: `cg routes --writes --unguarded` lists routes that write with no auth guard.
+- Across repos: `cg link` matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes, and checks request keys (Laravel FormRequest, Elysia schemas, Nuxt / TypeScript bodies).
+- Route guards: `cg routes --writes --unguarded` lists routes that write with no auth guard. Laravel checks inside the action count as inline guards unless `--strict`.
 - MCP server (`cg-mcp`) so agents query the graph instead of grepping.
 - Visual view (`cg serve`) and plan checks (`cg plan check`) for planned changes.
 
@@ -70,6 +70,6 @@ Go and others: import a SCIP index with `cg index --scip FILE`. Run `cg doctor`
 
 [Install](https://code-graph.cyberchronos00.workers.dev/docs/install) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Configuration](https://code-graph.cyberchronos00.workers.dev/docs/configuration) · [Architecture](https://code-graph.cyberchronos00.workers.dev/docs/architecture) · [Limitations](https://code-graph.cyberchronos00.workers.dev/docs/limitations)
 
-[Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md) · MIT [License](LICENSE)
+[Changelog](https://github.com/cyberchronos00/code-graph/blob/main/CHANGELOG.md) · [Contributing](https://github.com/cyberchronos00/code-graph/blob/main/CONTRIBUTING.md) · [Security](https://github.com/cyberchronos00/code-graph/blob/main/SECURITY.md) · MIT [License](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE)
 
-More recordings: [docs/media](docs/media).
+More recordings: [docs/media](https://github.com/cyberchronos00/code-graph/tree/main/docs/media).

{cg_code_graph-0.19.0 → cg_code_graph-0.20.0}/cg_code_graph/__init__.py

@@ -1,2 +1,2 @@
 """code-graph: deterministic code knowledge graph (beta)."""
-__version__ = "0.19.0"
+__version__ = "0.20.0"

{cg_code_graph-0.19.0 → cg_code_graph-0.20.0}/cg_code_graph/cli.py

@@ -171,7 +171,8 @@ def main(argv=None):
     p.add_argument("--writes", nargs="?", const="*", metavar="TABLE", help="routes reaching a DB write (any table, or TABLE)")
     p.add_argument("--reaches", nargs="+", metavar="SPEC", help="routes reaching any of these nodes (table, column, connection:, env:, Class.method)")
     p.add_argument("--missing", metavar="NAME", help="keep routes with no guard whose name contains NAME (e.g. auth:api, ApiKeyGuard)")
-    p.add_argument("--unguarded", action="store_true", help="keep routes with no auth guard (framework presets, the auth name pattern, .cg.yaml auth.extra_patterns and --auth-pattern)")
+    p.add_argument("--unguarded", action="store_true", help="keep routes with no auth guard (framework presets, the auth name pattern, .cg.yaml auth.extra_patterns and --auth-pattern). An unconditional inline check (Laravel authorize / permission / shared secret) counts; --strict ignores it")
+    p.add_argument("--strict", action="store_true", help="with --unguarded, count only route-level guards (inline checks are still listed)")
     p.add_argument("--auth-pattern", help="extra regex for guard names that count as auth")
     p.add_argument("--min-confidence", default="heuristic", choices=["heuristic", "resolved", "exact"])
     p.add_argument("--max-items", type=int, default=200); p.add_argument("--no-paths", action="store_true"); p.add_argument("--json", action="store_true")
@@ -548,7 +549,7 @@ def main(argv=None):
     if a.cmd == "routes":
         from . import routes as R
         res = R.routes_report(st, writes=a.writes, reaches=a.reaches, missing=a.missing, unguarded=a.unguarded,
-                              auth_pattern=a.auth_pattern, min_conf=a.min_confidence, platform=a.platform)
+                              strict=a.strict, auth_pattern=a.auth_pattern, min_conf=a.min_confidence, platform=a.platform)
         if a.json:
             res["completeness"] = R.route_completeness(st)
         print(json.dumps(res, indent=1, default=str) if a.json else R.render_routes(res, st, max_items=a.max_items, paths=not a.no_paths))

{cg_code_graph-0.19.0 → cg_code_graph-0.20.0}/cg_code_graph/core/extractors.py

@@ -5,8 +5,9 @@ The extractor sources ship inside the package (cg_code_graph/plugins/{ts,php,dar
 
 - a checkout whose extractor directory already has them (`npm ci` run there) keeps using that directory;
 - otherwise the sources are copied into a per-user cache directory and the dependencies installed there, on first
-  use or by `cg setup`. The directory is keyed by the lock file, so an update that only changes the extractor source
-  reuses the installed dependencies, and one that changes the lock file installs into a fresh directory.
+  use or by `cg setup`. The directory is keyed by the lock file and the extractor sources (names and contents), so a
+  release that adds or edits a module installs into a fresh directory. A cache directory that is missing a listed
+  source is incomplete and is rebuilt.
 
 Cache root (core/cache.py): $CG_CACHE, else %LOCALAPPDATA%\\cg on Windows,
 else $XDG_CACHE_HOME/cg or ~/.cache/cg; the extractors live in <root>/extractors.
@@ -46,7 +47,8 @@ class Spec:
 
 
 SPECS = {
-    "typescript": Spec("typescript", PLUGINS / "ts" / "extractor", ("extract.mjs", "fw.mjs", "package.json", "package-lock.json"),
+    "typescript": Spec("typescript", PLUGINS / "ts" / "extractor", ("extract.mjs", "fw.mjs", "rr.mjs", "package.json",
+                                                                  "package-lock.json"),
                        "package-lock.json", ("node_modules/typescript/package.json",), "npm", "TypeScript / JavaScript"),
     "php": Spec("php", PLUGINS / "php" / "extractor", ("extract.php", "composer.json", "composer.lock"), "composer.lock",
                 ("vendor/autoload.php",), "composer", "PHP"),
@@ -63,20 +65,42 @@ def _installed(d: Path, spec: Spec) -> bool:
     return any((d / m).exists() for m in spec.markers)
 
 
+def _missing_sources(spec: Spec, d: Path) -> list[str]:
+    """Listed sources that exist in the package but not in the cache directory."""
+    return [rel for rel in spec.sources if (spec.pkg / rel).exists() and not (d / rel).exists()]
+
+
+def _cache_key(spec: Spec) -> str:
+    """Lock file plus every source path and its bytes, so a new or edited module does not reuse an old install."""
+    h = hashlib.sha256()
+    lock = spec.pkg / spec.lock
+    h.update(lock.read_bytes() if lock.exists() else b"")
+    for rel in spec.sources:
+        h.update(b"\0")
+        h.update(rel.encode())
+        src = spec.pkg / rel
+        h.update(b"\0")
+        h.update(src.read_bytes() if src.exists() else b"")
+    return h.hexdigest()[:12]
+
+
 def cache_dir(lang: str) -> Path:
     spec = SPECS[lang]
-    lock = spec.pkg / spec.lock
-    key = hashlib.sha256(lock.read_bytes() if lock.exists() else b"").hexdigest()[:12]
-    return cache_root() / f"{lang}-{key}"
+    return cache_root() / f"{lang}-{_cache_key(spec)}"
 
 
 def workdir(lang: str) -> Path:
     """The directory the extractor runs from: the package's own one when its dependencies are installed there (a
-    development checkout), else the cache directory (sources synced into it; dependencies maybe not yet installed)."""
+    development checkout), else the cache directory (sources synced into it; dependencies maybe not yet installed).
+    A cache directory missing a listed source is rebuilt from the package sources."""
     spec = SPECS[lang]
     if _installed(spec.pkg, spec):
         return spec.pkg
     d = cache_dir(lang)
+    if d.exists() and _missing_sources(spec, d):
+        # Incomplete copy (for example a 0.19.0 typescript cache that predates a module): drop it and start over
+        # when the key still matches, otherwise cache_dir already points at a fresh directory.
+        shutil.rmtree(d, ignore_errors=True)
     _sync(spec, d)
     return d
 
@@ -101,7 +125,8 @@ def status(lang: str) -> dict:
     if _installed(spec.pkg, spec):
         return {"installed": True, "dir": str(spec.pkg), "where": "package"}
     d = cache_dir(lang)
-    return {"installed": _installed(d, spec), "dir": str(d), "where": "cache"}
+    ready = _installed(d, spec) and not _missing_sources(spec, d)
+    return {"installed": ready, "dir": str(d), "where": "cache"}
 
 
 JS_RUNTIME_MISSING = (

{cg_code_graph-0.19.0 → cg_code_graph-0.20.0}/cg_code_graph/coverage.py

@@ -338,6 +338,11 @@ def compute(root: str | Path, plugins: dict, scip_imported: bool = False, report
             e["syntax_error_files"] = len(se)
             e["parsed_with_errors"] = sum(1 for x in se if not x.get("parse_failed"))
             e["decls_lost"] = sum(x.get("decls_lost", 0) for x in se)
+        if lang == "typescript" and st and st.get("realtime_subscriptions_unresolved_receiver"):
+            e["realtime_subscriptions_unresolved_receiver"] = st["realtime_subscriptions_unresolved_receiver"]
+            at = st.get("realtime_subscriptions_unresolved_receiver_at") or []
+            if at:
+                e["realtime_subscriptions_unresolved_receiver_at"] = at[:8]
         if lang == "python" and st:
             for k in ("roots_mode", "source_roots", "roots_warnings", "roots_ambiguous", "module_name_collisions"):
                 if st.get(k):
@@ -497,6 +502,16 @@ def _entry_text(e: dict) -> str:
     return f"{e['language']} {e['files']} {e['status'].replace('_', ' ')}{errs}"
 
 
+def realtime_unresolved_lines(e: dict, indent: str = "  ") -> list[str]:
+    """'.private(...)' on a receiver that is not an Echo client, with a channel literal: where to look."""
+    n = e.get("realtime_subscriptions_unresolved_receiver") or 0
+    if not n or e.get("language") != "typescript":
+        return []
+    at = e.get("realtime_subscriptions_unresolved_receiver_at") or []
+    where = f" ({', '.join(at[:5])})" if at else ""
+    return [f"{indent}typescript: {n} .private(...) call{'s' if n != 1 else ''} on an unknown receiver{where}"]
+
+
 def syntax_error_lines(e: dict, all_files: bool = False, indent: str = "  ") -> list[str]:
     """'swift: syntax errors in 8 files, 12 declarations lost (most first):' and one line per file with its error
     line spans and the declarations lost there (5 files unless all_files), #73."""
@@ -702,6 +717,7 @@ def render(covs: dict[str, dict | None], all_files: bool = False) -> str:
                 out.append(f"    fix: {e['hint']}")
         for e in (cov or {}).get("languages", []):
             out += syntax_error_lines(e, all_files)
+            out += realtime_unresolved_lines(e)
         for e in (cov or {}).get("languages", []):     # which mode an exact-capable language ran in, and why
             if e["language"] in ("kotlin", "swift", "java") and not _is_gap(e) and e.get("reason"):
                 out.append(f"  {e['language']}: {e['files']} files {e['status']}: {e['reason']}")

{cg_code_graph-0.19.0 → cg_code_graph-0.20.0}/cg_code_graph/mcp_server.py

@@ -904,13 +904,16 @@ def explore(query: str, budget_tokens: int = 3000, max_symbols: int = 4) -> str:
 
 @tool
 def routes(writes: str | None = None, reaches: list[str] | None = None, missing: str | None = None,
-           unguarded: bool = False, auth_pattern: str | None = None, max_items: int = 40, paths: bool = True,
+           unguarded: bool = False, strict: bool = False, auth_pattern: str | None = None, max_items: int = 40, paths: bool = True,
            min_confidence: str = "heuristic", platform: str | None = None) -> str:
     """Routes with their middleware / guards / auth, in one call. Optional scope: writes="*" (routes that reach any
     DB write) or writes="<table>", reaches=[specs] (routes that reach any of these nodes: table, column, connection,
     method, env key...). Optional filters: missing="<name>" keeps routes with no guard whose name contains it (e.g.
     "auth:api", "ApiKeyGuard"), unguarded=true keeps routes with no auth guard (the framework presets' auth guards and
-    the auth name pattern; extend with auth_pattern, a regex, or .cg.yaml auth.extra_patterns). Each route: guards, what it reaches with one evidence chain, and the frontend callers on a
+    the auth name pattern; extend with auth_pattern, a regex, or .cg.yaml auth.extra_patterns). An unconditional
+    inline check on a Laravel action (authorize, Gate, a permission check, FormRequest::authorize, controller
+    middleware, a shared-secret compare) is listed under guards as `inline:` and counts for unguarded. strict=true
+    with unguarded counts only route-level guards. Each route: guards, what it reaches with one evidence chain, and the frontend callers on a
     combined graph. Guards come from Laravel middleware, Nest guards/interceptors, Express/Koa/Fastify/Hono/Elysia
     middleware, Next.js middleware.ts / handler wrappers, django-ninja auth= and Django/DRF view access checks.
     min_confidence: keep the default (heuristic) for reviews: every edge still shows its own label, and a stricter
@@ -923,7 +926,7 @@ def routes(writes: str | None = None, reaches: list[str] | None = None, missing:
     st = _st()
     pf, _ = _platform(st, platform)
     _scope(whole=True, categories=("route",), unsupported=False)
-    res = R.routes_report(st, writes=writes, reaches=reaches, missing=missing, unguarded=unguarded,
+    res = R.routes_report(st, writes=writes, reaches=reaches, missing=missing, unguarded=unguarded, strict=strict,
                           auth_pattern=auth_pattern, min_conf=min_confidence, platform=pf)
     return R.render_routes(res, st, max_items=max_items, paths=paths, compact=True)
 
@@ -1149,6 +1152,12 @@ def api_calls(filter: str = "all", max_items: int = 60) -> str:
         for c in r["calls"][:3]:
             h = f" via {short(c['via_helper']['fn'])}" if c.get("via_helper") else ""
             out.append(f"   ← {short(c['caller'])} @ {at(c['at'])}{h}")
+            bk = Q._key_names(c.get("body_keys"))
+            qk = Q._key_names(c.get("query_keys"))
+            if bk:
+                out.append(f"      body keys: {', '.join(bk)}")
+            if qk:
+                out.append(f"      query keys: {', '.join(qk)}")
         for g in gaps.get(r["endpoint"], [])[:3]:
             out.append(f"   ! {short(g['caller'])} @ {at(g['call_at'])} passes {', '.join(g['dropped'])}: sent but not forwarded "
                        f"(request sends {', '.join(g['request_keys'])})")