cg-code-graph 0.21.2__tar.gz → 0.23.0__tar.gz

{cg_code_graph-0.21.2/cg_code_graph.egg-info → cg_code_graph-0.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cg-code-graph
-Version: 0.21.2
+Version: 0.23.0
 Summary: cg: a code graph of routes, calls, data access and platform boundaries for agents and humans (CLI + MCP server)
 Author: cyberchronos00
 License-Expression: MIT
@@ -93,7 +93,7 @@ Go and others: import a SCIP index with `cg index --scip FILE`. Run `cg doctor`
 - Across repos: `cg link` matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes, and checks request keys (Laravel FormRequest, Elysia schemas, Nuxt / TypeScript bodies).
 - Route guards: `cg routes --writes --unguarded` lists routes that write with no auth guard. Laravel checks inside the action count as inline guards unless `--strict`.
 - Security views: `cg surface` lists the inbound / outbound attack surface and findings (hardcoded credentials, plaintext protocols, unverified webhooks, unguarded handlers, listeners on all interfaces, disabled TLS / SSH verification, plaintext gRPC, exposed IPC, outbound URLs built from request input) as text, JSON or SARIF, with `--fail-on` for CI.
-- MCP server (`cg-mcp`) so agents query the graph instead of grepping.
+- MCP server (`cg-mcp`) so agents query the graph instead of grepping. One server can serve many graphs (`graphs` plus an optional `graph` argument); a single `--db` stays one graph. See [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp).
 - Visual view (`cg serve`) and plan checks (`cg plan check`) for planned changes.
 
 ## Docs

{cg_code_graph-0.21.2 → cg_code_graph-0.23.0}/README.md

@@ -66,7 +66,7 @@ Go and others: import a SCIP index with `cg index --scip FILE`. Run `cg doctor`
 - Across repos: `cg link` matches client HTTP calls (frontends and Laravel / Guzzle backends) to server routes, and checks request keys (Laravel FormRequest, Elysia schemas, Nuxt / TypeScript bodies).
 - Route guards: `cg routes --writes --unguarded` lists routes that write with no auth guard. Laravel checks inside the action count as inline guards unless `--strict`.
 - Security views: `cg surface` lists the inbound / outbound attack surface and findings (hardcoded credentials, plaintext protocols, unverified webhooks, unguarded handlers, listeners on all interfaces, disabled TLS / SSH verification, plaintext gRPC, exposed IPC, outbound URLs built from request input) as text, JSON or SARIF, with `--fail-on` for CI.
-- MCP server (`cg-mcp`) so agents query the graph instead of grepping.
+- MCP server (`cg-mcp`) so agents query the graph instead of grepping. One server can serve many graphs (`graphs` plus an optional `graph` argument); a single `--db` stays one graph. See [MCP](https://code-graph.cyberchronos00.workers.dev/docs/mcp).
 - Visual view (`cg serve`) and plan checks (`cg plan check`) for planned changes.
 
 ## Docs

{cg_code_graph-0.21.2 → cg_code_graph-0.23.0}/cg_code_graph/__init__.py

@@ -1,2 +1,2 @@
 """code-graph: deterministic code knowledge graph (beta)."""
-__version__ = "0.21.2"
+__version__ = "0.23.0"

{cg_code_graph-0.21.2 → cg_code_graph-0.23.0}/cg_code_graph/cli.py

@@ -73,6 +73,13 @@ def _add_install_parser(sub, uninstall: bool):
     p.add_argument("--uninstall", action="store_true", help="remove the entry instead of writing it")
     p.add_argument("--dry-run", action="store_true", help="print the exact changes and write nothing")
     p.add_argument("--yes", action="store_true", help="skip the confirmation prompt")
+    if not uninstall:
+        p.add_argument("--registry", action="store_true",
+                       help="global single entry: cg-mcp with no --db; graphs come from the registry")
+        p.add_argument("--migrate", action="store_true",
+                       help="fold per-repo cg-* host entries into the graph registry (dry run unless --apply)")
+        p.add_argument("--apply", action="store_true", help="with --migrate, write the registry and the host config")
+        p.add_argument("--graphs", help="registry file for --migrate (default: ~/.config/cg/graphs.toml)")
 
 
 def _impact_labels(rows: list[dict], name_of, group_of) -> list[str]:
@@ -506,9 +513,14 @@ def main(argv=None):
                       mcp_file=a.mcp_file, dry_run=a.dry_run, assume_yes=a.yes)
     if a.cmd in ("install", "uninstall"):
         from .mcp_install import run as run_install
+        registry = bool(getattr(a, "registry", False))
+        migrate = bool(getattr(a, "migrate", False))
+        if (registry or migrate) and not a.project:
+            a.glob = True
         return run_install(a.host, scope="global" if a.glob else "project", root=a.dir, db=a.db,
                            tools=a.tools, portable=a.portable, remove=a.cmd == "uninstall" or a.uninstall,
-                           dry_run=a.dry_run, assume_yes=a.yes)
+                           dry_run=a.dry_run, assume_yes=a.yes, registry=registry, migrate=migrate,
+                           apply=bool(getattr(a, "apply", False)), graphs=getattr(a, "graphs", None))
     if a.cmd == "hooks":
         from . import hooks as HK
         return HK.run(a.action, root=a.dir, db=a.db, dry_run=a.dry_run, assume_yes=a.yes)
@@ -624,6 +636,8 @@ def main(argv=None):
         print(json.dumps(res, indent=1, default=str) if a.json else render_protocols(res, max_items=a.max_items))
         return
     if a.cmd == "tests":
+        if _unknown_route(st, a.spec, a.json):
+            return
         res = Q.tests_covering(st, a.spec, min_conf=a.min_confidence, near_depth=a.max_depth or None,
                                unit_only=a.unit_only, exclude_roots=a.exclude_root, through_roots=a.through_roots)
         res["completeness"] = _completeness(st, res.get("targets"))
@@ -662,12 +676,17 @@ def main(argv=None):
         print(json.dumps(res, indent=1, default=str) if a.json else Q.render_search(res))
         return
     if a.cmd == "reaches":
+        for spec in a.specs:
+            if _unknown_route(st, spec, a.json):
+                return
         res = Q.reaches(st, a.specs, min_conf=a.min_confidence, max_depth=a.max_depth, gate=None if a.gate == "none" else a.gate,
                         platform=a.platform, connection=a.connection)
         res["completeness"] = _completeness(st, [x for t in res["targets"].values() for x in t] + [i["id"] for i in res["items"]])
         print(json.dumps(res, indent=1, default=str) if a.json else Q.render_reaches(res, show_paths=not a.no_paths))
         _note(res["completeness"], a.json)
     elif a.cmd == "impact":
+        if _unknown_route(st, a.spec, a.json):
+            return
         res = Q.impact(st, a.spec, min_conf=a.min_confidence, platform=a.platform)
         if a.json:
             res["completeness"] = _completeness(st, list(res["targets"]) + [c["id"] for c in res["callers"]])
@@ -675,16 +694,19 @@ def main(argv=None):
         if res.get("platform"):
             from .platforms import render_filter
             print(render_filter(res["platform"]))
-            if res["platform"].get("targets_not_built"):
-                print(f"not built for {a.platform}: {', '.join(res['platform']['targets_not_built'][:6])}")
+            dropped = res["platform"].get("targets_not_built") or []
+            if dropped and res["targets"]:
+                print(f"not built for {a.platform}: {', '.join(dropped[:6])}")
+            if dropped and not res["targets"]:
+                msg = f"{a.spec} is not built for {a.platform}: nothing calls it there"
+                if Q.divergence_lists(st, a.platform, dropped):
+                    msg += (f" (`cg platforms divergence --target {a.platform}` lists references to it that would not build)")
+                print(msg); return
         print(f"targets: {res['targets'][:5]}")
         if not res["targets"]:
             print(f"no method matches {a.spec!r}; try `search` with part of the name"); return
-        if a.platform and res["targets"] and set(res["platform"]["targets_not_built"]) == set(res["targets"]):
-            msg = f"{a.spec} is not built for {a.platform}: nothing calls it there"
-            if Q.divergence_lists(st, a.platform, res["targets"]):
-                msg += (f" (`cg platforms divergence --target {a.platform}` lists references to it that would not build)")
-            print(msg); return
+        for d in res.get("default_arguments") or []:
+            print(f"via default argument: {d['src']} @ {d['file']}:{d['line']}")
         for line in Q.override_lines(res):
             print(line)
         if res.get("connections"):
@@ -740,6 +762,8 @@ def main(argv=None):
         res = Q.siblings(st, a.spec)
         print(json.dumps(res, indent=1, default=str) if a.json else Q.render_siblings(st, a.spec, res))
     elif a.cmd == "node":
+        if _unknown_route(st, a.spec, a.json):
+            return
         ids = list(dict.fromkeys(Q.resolve_targets(st, a.spec)))[:20]
         docs = [node_doc(st, nid) for nid in ids]
         if a.json:
@@ -759,10 +783,14 @@ def main(argv=None):
         if not p:
             raise SystemExit(1)  # scripts can tell "no path" apart from a path
     elif a.cmd == "downstream":
+        if _unknown_route(st, a.spec, a.json):
+            return
         res = Q.downstream(st, a.spec, min_conf=a.min_confidence, max_depth=a.max_depth, gate=None if a.gate == "none" else a.gate,
                            platform=a.platform)
         print(json.dumps(res, indent=1, default=str) if a.json else Q.render_downstream(res, show_paths=not a.no_paths))
     elif a.cmd == "api-calls":
+        if _unknown_route(st, a.spec, a.json):
+            return
         rows = Q.api_calls(st, a.spec)
         print(json.dumps(rows, indent=1, default=str) if a.json else Q.render_api_calls(rows))
         if not a.json:
@@ -774,6 +802,17 @@ def main(argv=None):
         doc = stats_doc(st)
         print(json.dumps(doc, indent=1, default=str) if a.json else render_stats(st, doc))
 
+def _unknown_route(st, spec: str, as_json: bool) -> bool:
+    miss = Q.route_failure(st, spec)
+    if not miss:
+        return False
+    if as_json:
+        print(json.dumps({"error": miss["error"], "spec": miss["spec"], "suggestions": miss["suggestions"]}))
+    else:
+        print(miss["text"])
+    raise SystemExit(1)
+
+
 def node_doc(st, nid: str) -> dict:
     """One node with its attrs parsed and its outgoing / incoming edges (`cg node --json`, #75)."""
     n = dict(st.node(nid))

{cg_code_graph-0.21.2 → cg_code_graph-0.23.0}/cg_code_graph/indexer.py

@@ -28,6 +28,19 @@ from .plugins.flutter.plugin import FlutterPlugin
 from .plugins.nest.plugin import NestPlugin
 from .plugins.nextjs.plugin import NextPlugin
 from .plugins.express.plugin import ExpressPlugin
+import subprocess
+
+
+def _git_head(root) -> str | None:
+    """Commit indexed for this root, when it is a git work tree."""
+    try:
+        proc = subprocess.run(["git", "-C", str(root), "rev-parse", "HEAD"],
+                              capture_output=True, text=True, timeout=8)
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    if proc.returncode != 0:
+        return None
+    return (proc.stdout or "").strip() or None
 from .plugins.astro.plugin import AstroPlugin
 from .plugins.kotlin.plugin import KotlinPlugin
 from .plugins.java.plugin import JavaPlugin
@@ -464,6 +477,9 @@ def index_project(root: str | Path, db_path: str | Path, name: str | None = None
     stats["nodes"] = len(builder.nodes)
     stats["edges"] = len(builder.edges)
     stats["index_seconds"] = round(time.time() - t0, 2)
-    store.set_meta(project=project.name, root=str(project.root), stats=stats, indexed_at=time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime()))
+    head = _git_head(project.root)
+    extra = {"commit": head} if head else {}
+    store.set_meta(project=project.name, root=str(project.root), stats=stats,
+                   indexed_at=time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime()), **extra)
     store.db.close()
     return stats

{cg_code_graph-0.21.2 → cg_code_graph-0.23.0}/cg_code_graph/link.py

@@ -101,20 +101,67 @@ def _method_ok(cm: str, rm: str) -> bool:
     return cm in rms or "ANY" in rms or (cm == "HEAD" and "GET" in rms)
 
 
+_BASE_SEG = re.compile(r"^(api|v\d+)$", re.I)
+
+
 def suffix_candidates(path: str, routes: list[dict]):
-    """Origin unknown: align the client path with the END of route URIs (prefix assumed to be the base)."""
+    """Align the client path with the end of a route only when the dropped prefix is a base path (`api`, `v1`)."""
     cs = _segs(path)
     out = []
     for r in routes:
         us = _segs(r["uri"])
         if len(us) <= len(cs):
             continue
+        dropped = us[:len(us) - len(cs)]
+        if any(not _BASE_SEG.match(seg) for seg in dropped):
+            continue
         ok, info = match_path("/" + "/".join(cs), "/" + "/".join(us[len(us) - len(cs):]))
         if ok and info["lit"] > 0:
             out.append((r, "suffix", info))
     return out
 
 
+def known_origin_text(attrs: dict) -> str | None:
+    """Env placeholder or literal base URL, when the client recorded one."""
+    kind = attrs.get("origin_kind")
+    origin = attrs.get("origin") or ""
+    base = attrs.get("base") or {}
+    if not isinstance(base, dict):
+        base = {}
+    parts = [origin, base.get("placeholder") or "", base.get("value") or ""]
+    text = " ".join(p for p in parts if isinstance(p, str) and p)
+    if kind == "env" or (isinstance(origin, str) and origin.startswith("{env.")):
+        return text or None
+    if kind == "other" or "://" in text:
+        return text or None
+    return None
+
+
+_GENERIC_ORIGIN = {"env", "base", "url", "api", "app", "http", "https", "host", "origin", "endpoint", "service", "internal"}
+
+
+def repos_for_origin(text: str, servers: list[str]) -> list[str] | None:
+    """Server names named by the origin.
+
+    ``None`` when the origin is a generic API base (``API_BASE_URL``) and does not name a repo:
+    matching stays as it was. ``[]`` when it names a service that is not one of ``servers``.
+    """
+    low = text.lower()
+    hits = []
+    for name in servers:
+        token = name.lower()
+        if len(token) < 3:
+            continue
+        if re.search(rf"(^|[^a-z0-9]){re.escape(token)}([^a-z0-9]|$)", low):
+            hits.append(name)
+    if hits:
+        return hits
+    tokens = [t for t in re.findall(r"[a-z][a-z0-9]+", low) if t not in _GENERIC_ORIGIN]
+    if not tokens:
+        return None
+    return []
+
+
 def match_endpoint(method: str, path: str, routes: list[dict], origin_kind: str = "api", origin: str | None = None,
                    base_prefix: str | None = None) -> dict:
     """base_prefix: path part of a configured base URL already folded into `path` (http node attrs.base); when the
@@ -388,7 +435,15 @@ def link_many(repos: list[tuple[str, str, str]], out_db: str, *, allow: dict | N
         targets = [s for s in server_names if (s != client or folded_self) and (client not in allow or s in allow[client])]
         pool = [rt for s in targets for rt in by_server[s]]
         bp = base_path((a.get("base") or {}).get("value") or "") if a.get("base") else None
+        origin_text = known_origin_text(a)
+        owners = repos_for_origin(origin_text, targets) if origin_text else None
+        if owners is not None and len(owners) == 1:
+            pool = [rt for rt in pool if rt["server"] == owners[0]]
         res = match_endpoint(a["method"], a["path"], pool, a.get("origin_kind", "api"), a.get("origin"), base_prefix=bp or None)
+        if origin_text and owners == [] and not res.get("matched") and a.get("origin_kind") != "other":
+            reason = res.get("reason") or ""
+            if reason.startswith(("no backend route", "not a backend URL")) or "suffix" in reason:
+                res["reason"] = "external (other origin)"
         res.update({"endpoint": ep_id, "method": a["method"], "calls": calls_by_ep.get(ep_id, []),
                     "_client": client, "_servers": targets})
         results.append(res)
@@ -448,13 +503,20 @@ def link_many(repos: list[tuple[str, str, str]], out_db: str, *, allow: dict | N
     for sc in scen[:1]:
         db.executemany("INSERT INTO node_entry_live VALUES (?,?,?,?,?)", [(sc, *r) for r in tag_entries_rows(nodes, edges, prop, skip_gate=sc)])
     db.commit()
+    # call sites whose wrapper no entry point reaches are matched, but not live
+    live_ids = {r[0] for r in db.execute("SELECT DISTINCT node_id FROM node_entry WHERE entry_kind != 'test'")}
+    for r in results:
+        for c in r["calls"]:
+            c["live"] = c.get("src") in live_ids
+        if r["matched"] and r["calls"] and not any(c.get("live") for c in r["calls"]):
+            r["no_live_caller"] = True
     # ---- stats: per call site and per distinct endpoint
     n_ep = len(results)
     m_ep = sum(1 for r in results if r["matched"])
     site_match = {}
     for r in results:
         for c in r["calls"]:
-            site_match[c["at"]] = site_match.get(c["at"], False) or bool(r["matched"])
+            site_match[c["at"]] = site_match.get(c["at"], False) or (bool(r["matched"]) and c.get("live", True))
     sites = list(site_match)
     m_sites = sum(1 for v in site_match.values() if v)
     conf_ct = defaultdict(int)
@@ -476,7 +538,7 @@ def link_many(repos: list[tuple[str, str, str]], out_db: str, *, allow: dict | N
             for r in eps:
                 hit = any(rmap[m["route"]]["server"] == server for m in r["matched"])
                 for c in r["calls"]:
-                    sm[c["at"]] = sm.get(c["at"], False) or hit
+                    sm[c["at"]] = sm.get(c["at"], False) or (hit and c.get("live", True))
             pair_stats.append({"client": client, "server": server, "endpoints": len(eps),
                                "endpoints_matched": sum(1 for r in eps if any(rmap[m["route"]]["server"] == server for m in r["matched"])),
                                "call_sites": len(sm), "call_sites_matched": sum(1 for v in sm.values() if v)})
@@ -497,10 +559,23 @@ def link_many(repos: list[tuple[str, str, str]], out_db: str, *, allow: dict | N
     for name, path, _role in repos:
         got = for_graph(GraphStore(path))
         cov.update({name: next(iter(got.values()))} if len(got) == 1 else got)
+    commits = {}
+    for name, path, _role in repos:
+        try:
+            member_st = GraphStore(path)
+            try:
+                member = member_st.meta()
+            finally:
+                member_st.db.close()
+        except Exception:
+            member = {}
+        if member.get("commit"):
+            commits[name] = member["commit"]
     store.set_meta(project="+".join(names), stats=stats, repos=names, coverage=cov,
                    sources={name: str(Path(path).resolve()) for name, path, _role in repos},
                    repo_roles={name: role for name, _path, role in repos}, link_clients=clients, link_allow=allow,
-                   indexed_at=time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime()))
+                   indexed_at=time.strftime("%Y-%m-%d %H:%M:%S UTC", time.gmtime()),
+                   **({"commit": commits} if commits else {}))
     db.close()
     return {"stats": stats, "results": results, "payload_issues": issues, "uncalled_routes": uncalled,
             "webhook_subscriptions": subscriptions, "external_callbacks": callbacks}
@@ -654,6 +729,11 @@ def write_match_report(res: dict, out_prefix: str) -> None:
         at = ", ".join(sorted({c["at"] for c in r["calls"]})[:3])
         extra = f" closest={r['closest']}" if r.get("closest") else (f" near={r['near']}" if r.get("near") else "")
         L.append(f"- `{r['endpoint']}` - {r['reason']}{extra} - at {at}")
+    dead = [r for r in res["results"] if r.get("no_live_caller")]
+    if dead:
+        L += ["", "## Matched, no live caller", ""]
+        for r in dead:
+            L.append(f"- `{r['endpoint']}` — matched, no live caller")
     L += ["", "## Ambiguous / heuristic matches", ""]
     for r in res["results"]:
         if r["matched"] and (len(r["matched"]) > 1 or any(m["confidence"] == "heuristic" for m in r["matched"])):