cg-code-graph 0.21.0__tar.gz → 0.21.2__tar.gz

{cg_code_graph-0.21.0/cg_code_graph.egg-info → cg_code_graph-0.21.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cg-code-graph
-Version: 0.21.0
+Version: 0.21.2
 Summary: cg: a code graph of routes, calls, data access and platform boundaries for agents and humans (CLI + MCP server)
 Author: cyberchronos00
 License-Expression: MIT
@@ -33,6 +33,8 @@ Dynamic: license-file
 
 For you and your AI agent (CLI + MCP). No LLM in the graph.
 
+<!-- mcp-name: io.github.cyberchronos00/cg-code-graph -->
+
 [![PyPI](https://img.shields.io/pypi/v/cg-code-graph)](https://pypi.org/project/cg-code-graph/) [![Downloads](https://img.shields.io/pepy/dt/cg-code-graph)](https://pepy.tech/project/cg-code-graph) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB)](https://pypi.org/project/cg-code-graph/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE) [![Docs](https://img.shields.io/badge/docs-code--graph-93b600)](https://code-graph.cyberchronos00.workers.dev/)
 
 [Docs](https://code-graph.cyberchronos00.workers.dev/) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Changelog](https://github.com/cyberchronos00/code-graph/blob/main/CHANGELOG.md)

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/README.md

@@ -6,6 +6,8 @@
 
 For you and your AI agent (CLI + MCP). No LLM in the graph.
 
+<!-- mcp-name: io.github.cyberchronos00/cg-code-graph -->
+
 [![PyPI](https://img.shields.io/pypi/v/cg-code-graph)](https://pypi.org/project/cg-code-graph/) [![Downloads](https://img.shields.io/pepy/dt/cg-code-graph)](https://pepy.tech/project/cg-code-graph) [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB)](https://pypi.org/project/cg-code-graph/) [![License: MIT](https://img.shields.io/badge/license-MIT-blue)](https://github.com/cyberchronos00/code-graph/blob/main/LICENSE) [![Docs](https://img.shields.io/badge/docs-code--graph-93b600)](https://code-graph.cyberchronos00.workers.dev/)
 
 [Docs](https://code-graph.cyberchronos00.workers.dev/) · [Quick start](https://code-graph.cyberchronos00.workers.dev/docs/quickstart) · [CLI](https://code-graph.cyberchronos00.workers.dev/docs/cli) · [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp) · [Changelog](https://github.com/cyberchronos00/code-graph/blob/main/CHANGELOG.md)

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/cg_code_graph/__init__.py

@@ -1,2 +1,2 @@
 """code-graph: deterministic code knowledge graph (beta)."""
-__version__ = "0.21.0"
+__version__ = "0.21.2"

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/cg_code_graph/cli.py

@@ -75,6 +75,20 @@ def _add_install_parser(sub, uninstall: bool):
     p.add_argument("--yes", action="store_true", help="skip the confirmation prompt")
 
 
+def _impact_labels(rows: list[dict], name_of, group_of) -> list[str]:
+    """Display names for one impact listing. Same-name rows in one group gain a file suffix."""
+    from collections import defaultdict
+    groups = defaultdict(list)
+    for i, row in enumerate(rows):
+        groups[group_of(row)].append(i)
+    labels = [name_of(row) for row in rows]
+    for idxs in groups.values():
+        named = Q.disambiguated([labels[i] for i in idxs], [rows[i].get("file") for i in idxs])
+        for i, lab in zip(idxs, named):
+            labels[i] = lab
+    return labels
+
+
 def main(argv=None):
     from . import __version__
     ap = argparse.ArgumentParser(prog="cg")
@@ -321,8 +335,8 @@ def main(argv=None):
     p.add_argument("--quiet", action="store_true", help="pass --quiet to each refresh")
     helps = {"reaches": "everything that depends on the targets, grouped by entry classification",
              "siblings": "code related to a symbol: class hierarchy, the same method in sibling classes, shared resources, co-callers",
-             "writers": "code that writes a table (or column), or a stored property `Type.prop`",
-             "readers": "code that reads a stored property `Type.prop` (READS_PROP)",
+             "writers": "code that writes a table, a column (`table.column`) or a stored property `Type.prop`",
+             "readers": "code that reads a table, a column (`table.column`) or a stored property `Type.prop`",
              "impact": "callers of a method up to their entry points (reverse walk), overrides listed apart",
              "stats": "node / edge counts of a graph DB",
              "node": "one node's details and its incoming / outgoing edges",
@@ -342,6 +356,9 @@ def main(argv=None):
         p.add_argument("--no-paths", action="store_true")
         p.add_argument("--max-depth", type=int, default=30)
         p.add_argument("--gate", default="auto", help="gate scenario for live/gated split (default: the one indexed; 'none' to disable)")
+        if name in ("reaches", "writers", "readers"):
+            p.add_argument("--connection", help="only the table / column edges that go to this database connection "
+                                                "(a dynamic name by its pattern, e.g. 'legacy_{store.id}'; docs/cli.md)")
         if name in ("reaches", "impact", "downstream"):
             p.add_argument("--platform", help="only code built for this target (windows, linux, macos, ios, android, web; see docs/platforms.md)")
         if name == "impact":
@@ -646,7 +663,7 @@ def main(argv=None):
         return
     if a.cmd == "reaches":
         res = Q.reaches(st, a.specs, min_conf=a.min_confidence, max_depth=a.max_depth, gate=None if a.gate == "none" else a.gate,
-                        platform=a.platform)
+                        platform=a.platform, connection=a.connection)
         res["completeness"] = _completeness(st, [x for t in res["targets"].values() for x in t] + [i["id"] for i in res["items"]])
         print(json.dumps(res, indent=1, default=str) if a.json else Q.render_reaches(res, show_paths=not a.no_paths))
         _note(res["completeness"], a.json)
@@ -664,20 +681,26 @@ def main(argv=None):
         if not res["targets"]:
             print(f"no method matches {a.spec!r}; try `search` with part of the name"); return
         if a.platform and res["targets"] and set(res["platform"]["targets_not_built"]) == set(res["targets"]):
-            print(f"{a.spec} is not built for {a.platform}: nothing calls it there (`cg platforms divergence --target "
-                  f"{a.platform}` lists references to it that would not build)"); return
+            msg = f"{a.spec} is not built for {a.platform}: nothing calls it there"
+            if Q.divergence_lists(st, a.platform, res["targets"]):
+                msg += (f" (`cg platforms divergence --target {a.platform}` lists references to it that would not build)")
+            print(msg); return
         for line in Q.override_lines(res):
             print(line)
+        if res.get("connections"):
+            print(Q.connections_line(res["connections"]))
         if not res["callers"] and not res["entry_points"]:
             print(Q.explain_no_callers(st, a.spec, res["targets"], a.min_confidence)); return
         print(f"callers (transitive): {len(res['callers'])}")
-        for c in res["callers"]:
+        caller_names = _impact_labels(res["callers"], lambda c: c.get("fqn") or c["id"], lambda c: c.get("module") or c.get("kind"))
+        for c, nm in zip(res["callers"], caller_names):
             loc = f"  @ {c['file']}:{c['line']}" if Q.NATIVE_FILE_RE.search(c.get("file") or "") else ""
-            print(f"  d={c['depth']} [{c['module'] or c['kind']}] {c['fqn']}{loc}{Q.caller_label(c)}")
+            print(f"  d={c['depth']} [{c['module'] or c['kind']}] {nm}{loc}{Q.caller_label(c)}")
         print(f"entry points: {len(res['entry_points'])}")
-        for e in res["entry_points"]:
+        entry_names = _impact_labels(res["entry_points"], lambda e: e["name"], lambda e: e.get("entry_kind"))
+        for e, nm0 in zip(res["entry_points"], entry_names):
             native = Q.NATIVE_FILE_RE.search(e.get("file") or "")
-            nm = f"{e.get('fqn') or e['name']}  @ {e['file']}:{e['line']}" if native else e["name"]
+            nm = f"{e.get('fqn') or e['name']}  @ {e['file']}:{e['line']}" if native else nm0
             print(f"  {e['entry_kind']:16} {nm}  conf={e['path_confidence']}{Q.CANDIDATE_LABEL if e.get('candidate') else ''}"
                   f"{Q.generated_label(e)}{Q.platform_label(e)}")
             if not a.no_paths:
@@ -702,17 +725,14 @@ def main(argv=None):
         res = RT.roundtrip(st, a.spec, include_tests=a.tests)
         print(RT.to_json(res) if a.json else RT.render(res))
     elif a.cmd in ("writers", "readers"):
-        rows = Q.writers(st, a.spec) if a.cmd == "writers" else Q.readers(st, a.spec)
+        groups = Q.access(st, a.spec, a.cmd, a.connection)
+        rows = [r for g in groups for r in g["rows"]]
         if a.json:
             print(json.dumps(rows, indent=1)); return
         if not rows:
-            print(Q.explain_no_writers(st, a.spec, a.cmd)); return
-        for r in rows:
-            ek = ",".join(sorted(r["entry_kinds"]))
-            ex = {k: v for k, v in (r.get("attrs") or {}).items() if k in ("receiver", "accessor", "storage")}
-            extra = ("  " + " ".join(f"{k}={v}" for k, v in ex.items())) if ex else ""
-            kind = f"{r['kind']}({r['attrs']['orig']})" if r.get("test") else r['kind']
-            print(f"[{r['module']}] {r['fqn']}  {kind} {r['dst']}  @{r['file']}:{r['line']} ({r['confidence']}){extra}  entries: {ek}")
+            print(Q.explain_no_connection(st, a.spec, a.connection, a.cmd) if a.connection else Q.explain_no_writers(st, a.spec, a.cmd))
+            return
+        print("\n".join(Q.render_access(groups)))
         verb = "write" if a.cmd == "writers" else "read"
         nt = sum(1 for r in rows if r.get("test"))
         print(f"{len(rows)} {verb} edges, {len({r['src'] for r in rows})} {a.cmd}" + (f" ({nt} from test code)" if nt else ""))
@@ -773,6 +793,14 @@ def node_doc(st, nid: str) -> dict:
     return {"node": n, "out": edges("src", "dst"), "in": edges("dst", "src")}
 
 
+def _mass_note(e: dict) -> str:
+    """`  via update(validated()) keys from UpdateBookRequest::rules ∩ Book::$fillable` for a mass-assignment column write (#177)."""
+    at = e.get("attrs") or {}
+    if e["kind"] != "WRITES_COLUMN" or not at.get("mass_assignment"):
+        return ""
+    return f"  via {at.get('via')}" + (f" keys from {' ∩ '.join(at['keys_from'])}" if at.get("keys_from") else "")
+
+
 def render_node(d: dict) -> str:
     """`cg node` text: the node's location, kind and attrs, then its edges; the same edge from one site (one row per
     gate scenario or accessor) is listed once with a count."""
@@ -801,10 +829,10 @@ def render_node(d: dict) -> str:
         out.append(f"  {'outgoing' if key == 'out' else 'incoming'} ({len(es)}):" if es else f"  {'outgoing' if key == 'out' else 'incoming'}: none")
         seen: dict = {}
         for e in es:
-            k = (e["kind"], e[other], e["file"], e["line"], e["confidence"])
+            k = (e["kind"], e[other], e["file"], e["line"], e["confidence"], _mass_note(e))
             seen[k] = seen.get(k, 0) + 1
-        for (kind, o, f, line, conf), c in seen.items():
-            out.append(f"    {arrow} {kind} {o}  @{f}:{line} {conf}" + (f"  ×{c}" if c > 1 else ""))
+        for (kind, o, f, line, conf, note), c in seen.items():
+            out.append(f"    {arrow} {kind} {o}  @{f}:{line} {conf}{note}" + (f"  ×{c}" if c > 1 else ""))
     return "\n".join(out)
 
 

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/cg_code_graph/core/redact.py

@@ -1,7 +1,9 @@
 """Secret values never reach the graph database (#47).
 
-A literal that belongs to a credential-looking key (password, secret, token, key, api_key, auth, private, credential,
-passphrase, dsn, ...) is stored as `redacted:hmac:<first 8 hex of HMAC-SHA-256(graph salt, value)>`: enough to see that
+A literal that belongs to a credential-looking key (its last word is password, secret, dsn, ..., or an
+explicit compound such as api_key; a bare `key` / `token` counts unless a known non-secret word precedes it
+(`primary_key`, `cache.key`), whatever the value looks like; `AUTH_GUARD` or `..._TOKEN_TABLE`
+do not count) is stored as `redacted:hmac:<first 8 hex of HMAC-SHA-256(graph salt, value)>`: enough to see that
 a literal exists and to tell two values apart within one graph, not enough to recover one, and not recognisable by
 hashing a common password. The salt is `secrets.token_hex(16)`, created on the first index of a graph DB, kept in its
 `meta` table (`redact_salt`) and carried over by a re-index or refresh of that DB; a new DB gets a new salt, so markers
@@ -20,29 +22,52 @@ import secrets
 
 MARK = "redacted:hmac:"
 LEGACY_MARK = "redacted:sha256:"
-SECRET_WORDS = ("PASSWORD", "PASS", "PASSWD", "SECRET", "TOKEN", "SECRET_KEY", "SECRET_ACCESS_KEY", "KEY", "AUTH", "PWD")
-_EXTRA_WORDS = {"PASSWORD", "PASSWD", "PWD", "PASSPHRASE", "SECRET", "SECRETS", "TOKEN", "TOKENS", "AUTH", "AUTHORIZATION",
-                "CREDENTIAL", "CREDENTIALS", "PRIVATE", "APIKEY", "DSN", "BEARER", "SALT", "SIGNATURE"}
-_NOT_SECRET_TAIL = ("_KEY_ID", "_PUBLIC_KEY", "_KEY_PATH")
+_SECRET_LAST = {"password", "passwd", "pwd", "pass", "passphrase", "secret", "dsn"}
+_SECRET_COMPOUNDS = {("api", "key"), ("apikey",), ("access", "key"), ("secret", "key"), ("private", "key"),
+                     ("signing", "key"), ("encryption", "key"), ("client", "secret"), ("webhook", "secret"),
+                     ("auth", "token"), ("api", "token"), ("access", "token"), ("refresh", "token"), ("bearer", "token")}
+_BARE_LAST = {"key", "token"}
+SECRET_WORDS = tuple(sorted({w.upper() for w in _SECRET_LAST} | {"_".join(c).upper() for c in _SECRET_COMPOUNDS}
+                            | {w.upper() for w in _BARE_LAST}))
+_NON_SECRET_BEFORE = {"primary", "foreign", "sort", "partition", "route", "cache", "idempotency", "remember", "csrf",
+                      "xsrf", "public", "i18n", "translation", "lookup", "unique", "index", "storage", "prefix"}
 _URL_PW = re.compile(r"(?P<head>\b[A-Za-z][\w+.-]*://[^/\s:@'\"]*:)(?P<pw>[^@/\s'\"]+)(?P<tail>@)")
 _PLACEHOLDER = ("${", "{{", "%(", "<", "$")
 
 
-def secret_key(key: str) -> bool:
-    """The `cg surface` rule for a config key / env name that holds a credential."""
-    k = re.sub(r"[^A-Za-z0-9]+", "_", key).upper().strip("_")
-    return any(k.endswith("_" + s) or k == s for s in SECRET_WORDS) and not k.endswith(_NOT_SECRET_TAIL)
-
-
-def looks_secret(key: str) -> bool:
-    """Wider than `secret_key`: any word of the name says credential (private_key_pem, db_dsn, apiKey, auth_header)."""
-    if secret_key(key):
+def _words(segment: str) -> list[str]:
+    spaced = re.sub(r"([a-z])([A-Z])", r"\1_\2", segment)
+    return [w for w in re.split(r"[^A-Za-z0-9]+", spaced.lower()) if w]
+
+
+def secret_key(key: str, value=None) -> bool:
+    """Whether a config key / env name holds a credential, from the words of the name (split on `.`, `_`, `-` and
+    camelCase). A credential when the last word is password, passwd, pwd, pass, passphrase, secret or dsn, when the
+    name ends in an explicit compound (api_key, access_key, signing_key, client_secret, auth_token, refresh_token, ...),
+    or for Laravel's `app.key` / `APP_KEY`. A bare `key` or `token` as last word is a credential by default, as it
+    was in 0.21.0, and is kept only when the word before it (a dotted segment counts) is a known non-secret one
+    (primary, foreign, sort, partition, route, cache, idempotency, remember, csrf, xsrf, public, i18n, translation,
+    lookup, unique, index, storage, prefix). The value never decides: a token can be any shape (lowercase words,
+    dotted, `key-` prefixed), so `value` is accepted for the callers' signature only. A credential word earlier in the name never counts
+    (`AUTH_GUARD`, `AUTH_PASSWORD_BROKER`, `AUTH_PASSWORD_RESET_TOKEN_TABLE`, `try_it_credentials_policy`), and
+    `*_PUBLIC_KEY`, `*_KEY_ID`, `*_KEY_PATH`, `*_KEY_FILE` are not credentials."""
+    key = str(key)
+    words = _words(key.rsplit(".", 1)[-1])
+    if not words:
+        return False
+    all_words = _words(key)
+    if all_words == ["app", "key"]:
         return True
-    spaced = re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", str(key))
-    words = [w for w in re.split(r"[^A-Za-z0-9]+", spaced.upper()) if w]
-    if any(w in _EXTRA_WORDS for w in words):
+    if words[-1] in _SECRET_LAST or any(tuple(words[-n:]) in _SECRET_COMPOUNDS for n in (1, 2) if len(words) >= n):
         return True
-    return "KEY" in words and not set(words) & {"PUBLIC", "ID", "PATH", "FILE", "NAME", "PREFIX", "TYPE", "SIZE", "LENGTH"}
+    if words[-1] not in _BARE_LAST:
+        return False
+    if len(all_words) > 1 and all_words[-2] in _NON_SECRET_BEFORE:
+        return False
+    return True
+
+
+looks_secret = secret_key
 
 
 def is_redacted(v) -> bool:
@@ -79,7 +104,7 @@ def redact(value, key: str | None, salt: str):
     by one, anything else unchanged. Non-strings and placeholders pass through."""
     if not isinstance(value, str):
         return value
-    if key is not None and looks_secret(key) and not placeholder(value):
+    if key is not None and looks_secret(key, value) and not placeholder(value):
         return marker(value, salt)
     return redact_url(value, salt)
 
@@ -100,7 +125,7 @@ def _holds_secret(d: dict, k: str) -> bool:
     if k.lower() in _DIRECT:
         return not _REFERENCE.match(str(d[k]))
     if k in _VALUE_KEYS:
-        return any(isinstance(d.get(nk), str) and looks_secret(d[nk]) for nk in _NAME_KEYS)
+        return any(isinstance(d.get(nk), str) and looks_secret(d[nk], d.get(k)) for nk in _NAME_KEYS)
     return False
 
 

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/cg_code_graph/coverage.py

@@ -233,9 +233,20 @@ def file_completeness(discovered: list[str], report: dict) -> dict:
     for b in BUCKETS:
         res[b] = len(out[b])
     res["paths"] = {b: v[:MAX_PATHS] for b, v in out.items() if v}
+    if out["excluded"]:
+        res["exclude_reasons"] = {f: _exclude_reason(f) for f in out["excluded"]}
     return res
 
 
+def _exclude_reason(path: str) -> str:
+    """Why a discovered file was left out of the graph: tool config, a test file, or a `.cg.yaml` exclude."""
+    if _TOOL_FILE.search(path):
+        return "tool config"
+    if _TEST_NAME.search(path):
+        return "test file"
+    return ".cg.yaml exclude"
+
+
 def missing_files(e: dict) -> int:
     """Discovered files of a language entry that are not in the graph for a reason other than a deliberate exclusion."""
     return sum(e.get(b, 0) for b in ("parse_failed", "skipped_oversize", "unmapped"))
@@ -308,6 +319,8 @@ def compute(root: str | Path, plugins: dict, scip_imported: bool = False, report
         status, reason = _status(lang, st)
         e = {"language": lang, "files": n, "status": status,
              "by_ext": {x: files[x] for x in exts if files[x]}}
+        if lang == "typescript" and not any(x in e["by_ext"] for x in (".ts", ".tsx", ".mts", ".cts")):
+            e["label"] = "javascript"
         if reason:
             e["reason"] = reason
         if status in ("skipped", "heuristic", "not_indexed"):
@@ -495,16 +508,22 @@ def blind_spots(cov: dict | None) -> list[dict]:
     return list((cov or {}).get("blind_spots") or [])
 
 
+def _shown_lang(e: dict) -> str:
+    """Display name. A TypeScript-plugin entry with no .ts/.tsx/.mts/.cts files reads as javascript; JSON keeps `language`."""
+    return e.get("label") or e["language"]
+
+
 def _entry_text(e: dict) -> str:
     """'php 18 exact' / 'python 4 discovered, 2 indexed (exact parser): 1 parse failed, 1 unmapped' /
-    'swift 101 heuristic, 8 parsed with syntax errors'."""
+    'javascript 12 discovered, 2 indexed (exact parser): 9 unmapped, 1 excluded'."""
     pe = e.get("parsed_with_errors")
     errs = f", {pe} parsed with syntax errors" if pe else ""
+    name = _shown_lang(e)
     if e.get("files_complete") is False:
-        parts = [f"{e[b]} {BUCKET_SHORT[b]}" for b in ("parse_failed", "skipped_oversize", "unmapped") if e.get(b)]
-        return (f"{e['language']} {e['files']} discovered, {e['indexed']} indexed ({e['status'].replace('_', ' ')} parser)"
+        parts = [f"{e[b]} {BUCKET_SHORT[b]}" for b in BUCKETS if e.get(b)]
+        return (f"{name} {e['files']} discovered, {e['indexed']} indexed ({e['status'].replace('_', ' ')} parser)"
                 + (": " + ", ".join(parts) if parts else "") + errs)
-    return f"{e['language']} {e['files']} {e['status'].replace('_', ' ')}{errs}"
+    return f"{name} {e['files']} {e['status'].replace('_', ' ')}{errs}"
 
 
 def realtime_unresolved_lines(e: dict, indent: str = "  ") -> list[str]:
@@ -579,11 +598,16 @@ def _paths_lines(e: dict, all_files: bool, indent: str = "    ") -> list[str]:
     out = []
     for b in BUCKETS:
         ps = (e.get("paths") or {}).get(b) or []
-        if not ps or (b == "excluded" and not all_files):
+        if not ps:
             continue
         show = ps if all_files else ps[:SHOW_PATHS]
         more = e.get(b, len(ps)) - len(show)
-        out.append(f"{indent}{BUCKET_SHORT[b]}: " + ", ".join(show) + (f" … +{more} more (--all-files)" if more > 0 else ""))
+        if b == "excluded":
+            reasons = e.get("exclude_reasons") or {}
+            body = ", ".join(f"{p} ({reasons.get(p) or _exclude_reason(p)})" for p in show)
+        else:
+            body = ", ".join(show)
+        out.append(f"{indent}{BUCKET_SHORT[b]}: " + body + (f" … +{more} more (--all-files)" if more > 0 else ""))
     return out
 
 
@@ -720,11 +744,12 @@ def render(covs: dict[str, dict | None], all_files: bool = False) -> str:
         for e in gaps(cov):
             any_gap = True
             exts = ", ".join(f"{k} {v}" for k, v in sorted(e["by_ext"].items()))
+            shown = _shown_lang(e)
             if e.get("files_complete") is False:
                 parts = [f"{e[b]} {BUCKET_SHORT[b]}" for b in BUCKETS if e.get(b)]
-                line = f"  {e['language']}: {e['files']} files ({exts}) {e['indexed']} indexed, " + ", ".join(parts)
+                line = f"  {shown}: {e['files']} files ({exts}) {e['indexed']} indexed, " + ", ".join(parts)
             else:
-                line = f"  {e['language']}: {e['files']} files ({exts}) {e['status'].replace('_', ' ')}"
+                line = f"  {shown}: {e['files']} files ({exts}) {e['status'].replace('_', ' ')}"
             if e.get("reason"):
                 line += f": {e['reason']}"
             out.append(line)
@@ -795,7 +820,7 @@ def note(covs: dict[str, dict | None]) -> str:
         for e in gaps(c):
             what = (f"{e['indexed']} of {e['files']} files indexed" if e.get("files_complete") is False
                     else f"{e['files']} files, {e['status'].replace('_', ' ')}")
-            bad.append(f"{e['language']} ({what}{', ' + r if len(covs) > 1 else ''})")
+            bad.append(f"{_shown_lang(e)} ({what}{', ' + r if len(covs) > 1 else ''})")
     bs = [b for c in covs.values() for b in blind_spots(c)]
     bs_txt = f"; blind spots: {_bs_count(bs)} (see coverage)" if bs else ""
     nerr = sum(e.get("syntax_error_files", 0) for c in covs.values() for e in (c or {}).get("languages", []))
@@ -956,6 +981,18 @@ def completeness_for(store, node_ids=None, categories=("route", "handler"), whol
                         categories=categories, ids=set(node_ids), files=sc["files"], **kw)
 
 
+def _unsupported_text(uns: dict) -> str:
+    """`unsupported: sh 3`. A single-repo DB drops a `shop/sh` prefix; a combined graph keeps `api/sh`."""
+    keys = list(uns)
+    prefixes = {k.partition("/")[0] for k in keys if "/" in k}
+    drop = len(prefixes) <= 1
+    parts = []
+    for k, v in sorted(uns.items()):
+        label = k.partition("/")[2] if drop and "/" in k else k
+        parts.append(f"{label} {v}")
+    return "unsupported: " + ", ".join(parts)
+
+
 def possibly_more(comp: dict) -> str:
     """'1 unmodelled route registration, 2 Python files not indexed' for an incomplete answer, '' when complete."""
     if comp.get("complete"):
@@ -990,7 +1027,7 @@ def possibly_more(comp: dict) -> str:
         parts.append(f"{len(se)} file{'s' if len(se) != 1 else ''} with syntax errors ({x['file']}{pos}"
                      + (f" +{len(se) - 1}" if len(se) > 1 else "") + ")")
     if comp.get("unsupported"):
-        parts.append("unsupported: " + ", ".join(f"{k} {v}" for k, v in sorted(comp["unsupported"].items())))
+        parts.append(_unsupported_text(comp["unsupported"]))
     if comp.get("recorded") is False:
         parts.append("coverage not recorded")
     return ", ".join(parts)

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/cg_code_graph/external.py

@@ -292,8 +292,35 @@ def read_spring_datasources(root: Path) -> list:
         out.append(fact)
     return out
 
+
+CONNECTION_EDGE_KINDS = ("READS_TABLE", "WRITES_TABLE", "READS_COLUMN", "WRITES_COLUMN", "MENTIONS_COLUMN")
+
+
+def table_connections(builder) -> int:
+    """`attrs.connections` of a table node: `{connection: edge count}` over its table / column edges that carry
+    `attrs.connection` (most used first). One table name used on several connections stays one node. Not tied to an ORM:
+    a plugin only has to set `attrs.connection` on its table / column edges."""
+    counts: dict[str, dict[str, int]] = {}
+    for e in builder.edges.values():
+        conn = (e.attrs or {}).get("connection")
+        if e.kind not in CONNECTION_EDGE_KINDS or not conn:
+            continue
+        key = e.dst.split(":", 1)[1]
+        tid = f"table:{key}" if e.dst.startswith("table:") else f"table:{key.rsplit('.', 1)[0]}"
+        counts.setdefault(tid, {})
+        counts[tid][conn] = counts[tid].get(conn, 0) + 1
+    n = 0
+    for tid, c in counts.items():
+        node = builder.nodes.get(tid)
+        if node is not None:
+            node.attrs["connections"] = dict(sorted(c.items(), key=lambda kv: (-kv[1], kv[0])))
+            n += 1
+    return n
+
+
 def attach(builder, root: Path) -> dict:
     root = Path(root)
+    table_connections(builder)
     envs = {n.id[len("env:"):]: n for n in builder.nodes.values() if n.kind == "env"}
     conns = [n for n in builder.nodes.values() if n.kind == "connection"]
     # Spring datasources before the empty-check so a repo with only application*.properties still indexes (#41)
@@ -646,6 +673,16 @@ def attach(builder, root: Path) -> dict:
                          (builder.nodes[nid].attrs or {}).get("confidence") or "resolved",
                          op="table", via="laravel connection")
         st["tables"] = st.get("tables", 0) + 1
+    # a table used on several connections: one CONNECTS_TO per connection that maps to a system, not only the first
+    for n in builder.nodes.values():
+        if n.kind != "table":
+            continue
+        for cname in (n.attrs or {}).get("connections") or {}:
+            nid = conn_ext.get(f"connection:{cname}")
+            if nid:
+                builder.add_edge(n.id, nid, "CONNECTS_TO", n.file, n.line,
+                                 (builder.nodes[nid].attrs or {}).get("confidence") or "resolved",
+                                 op="table", via=f"connection {cname}")
 
     # ---- ORM tables without a datasource block: attach to the sole SQL system of the project (#41 step 2)
     # Immich (Kysely + DB_URL), Nest TypeORM (@Entity + DATABASE_URL) when no DataSource fact named them.

{cg_code_graph-0.21.0 → cg_code_graph-0.21.2}/cg_code_graph/mcp_install.py

@@ -161,7 +161,7 @@ def has_type(host: str) -> bool:
 
 def config_path(host: str, scope: str, root: Path) -> Path:
     """Filesystem path for a host and scope. Claude Code global has no file cg edits."""
-    root = Path(root)
+    root = _child(root)
     if host == "claude" and scope == "global":
         raise InstallError("Claude Code global scope is changed with the claude CLI, not a file")
     if host == "claude-desktop" and scope == "project":