code-graph-rag 0.0.589__tar.gz → 0.0.662__tar.gz

{code_graph_rag-0.0.589/code_graph_rag.egg-info → code_graph_rag-0.0.662}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-graph-rag
-Version: 0.0.589
+Version: 0.0.662
 Summary: The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
 License-Expression: MIT
 Keywords: rag,retrieval-augmented-generation,knowledge-graph,code-analysis,tree-sitter,mcp,mcp-server,llm,graph-database,semantic-search,codebase,memgraph,developer-tools,monorepo
@@ -33,11 +33,12 @@ Requires-Dist: typer>=0.21.1
 Requires-Dist: rich>=14.2.0
 Requires-Dist: prompt-toolkit>=3.0.52
 Requires-Dist: diff-match-patch>=20241021
-Requires-Dist: click>=8.3.1
+Requires-Dist: click>=8.3.3
 Requires-Dist: protobuf>=6.33.5
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: huggingface-hub[hf-xet]>=1.7.2
 Requires-Dist: pathspec>=1.0.4
+Requires-Dist: pygments>=2.20.0
 Provides-Extra: test
 Requires-Dist: pytest>=8.4.1; extra == "test"
 Requires-Dist: pytest-asyncio>=1.0.0; extra == "test"
@@ -88,6 +89,7 @@ Point it at a repository and it reads every source file, extracts functions, cla
 - Trace data flow through assignments, calls, and I/O sinks via `FLOWS_TO` taint edges.
 - Optimise code against language best practices or your own coding standards.
 - Find dead code by walking call and reference edges from entry points.
+- Overlay runtime behaviour: trace a test run (or pull production eBPF profiles) and merge the calls that actually happened into the graph, exposing dispatch that static analysis cannot see.
 - Group several repositories into a named workspace and query them as one graph.
 - Trace calls between microservices: route decorators become endpoint templates, and HTTP client URLs resolve to the handlers that serve them, linking services across project boundaries.
 
@@ -188,6 +190,40 @@ cgr status                                 # stack state and last sync per proje
 cgr doctor                                 # check dependencies and configuration
 ```
 
+## Runtime Call Tracing
+
+Static analysis cannot see calls through interfaces, reflection, registries, or framework routing. `cgr trace` records which functions actually called which while your code runs (typically the test suite) and merges the observations into the graph as `CALLS` edges with dynamic provenance: `dynamic: true`, observed call counts, the workloads (tests) that exercised each edge, and `static_missed: true` where no static edge existed.
+
+Index the repository first (`cgr start --repo-path ./my-project --update-graph`), then:
+
+**Python** (a pytest plugin ships with the package, inert unless enabled):
+
+```bash
+cd ./my-project
+pytest --cgr-trace                              # writes cgr-trace.jsonl
+cgr trace ingest cgr-trace.jsonl --repo-path .  # merge into the graph
+```
+
+**Node.js / TypeScript** (V8's built-in profiler, no agent needed; source maps are followed back to the original TypeScript):
+
+```bash
+node --cpu-prof --cpu-prof-name=run.cpuprofile app.js
+cgr trace convert run.cpuprofile --repo-path ./my-project --workload smoke
+cgr trace ingest cgr-trace.jsonl --repo-path ./my-project
+```
+
+**Production overlay** (eBPF continuous profilers: Parca, Pyroscope, OpenTelemetry). Fetch a pprof over HTTP and convert it in one step, re-anchoring build paths to your checkout:
+
+```bash
+cgr trace pull "https://parca.example/query?...&format=pprof" \
+    --repo-path ./my-project --language go \
+    --path-map /build/src/=./my-project/src/ \
+    --label endpoint --header "Authorization=Bearer $TOKEN"
+cgr trace ingest cgr-trace.jsonl --repo-path ./my-project
+```
+
+The JVM (Java, Scala), .NET, PHP, Lua, Dart, Go, Rust, and C/C++ each have a recording recipe in the [Dynamic Call Tracing guide](https://docs.code-graph-rag.com/guide/dynamic-tracing/). Ingest is idempotent, so a cron'd `pull` plus `ingest` keeps a continuously refreshing production overlay. The absence of a dynamic edge never means dead code; it only means the traced workload did not exercise that path.
+
 ## MCP Server
 
 Run `cgr mcp-server` to serve the tools over stdio or HTTP for Claude Code and other MCP clients. The MCP surface registers:

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/PYPI_README.md

@@ -13,6 +13,7 @@ Point it at a repository and it reads every source file, extracts functions, cla
 - Trace data flow through assignments, calls, and I/O sinks via `FLOWS_TO` taint edges.
 - Optimise code against language best practices or your own coding standards.
 - Find dead code by walking call and reference edges from entry points.
+- Overlay runtime behaviour: trace a test run (or pull production eBPF profiles) and merge the calls that actually happened into the graph, exposing dispatch that static analysis cannot see.
 - Group several repositories into a named workspace and query them as one graph.
 - Trace calls between microservices: route decorators become endpoint templates, and HTTP client URLs resolve to the handlers that serve them, linking services across project boundaries.
 
@@ -113,6 +114,40 @@ cgr status                                 # stack state and last sync per proje
 cgr doctor                                 # check dependencies and configuration
 ```
 
+## Runtime Call Tracing
+
+Static analysis cannot see calls through interfaces, reflection, registries, or framework routing. `cgr trace` records which functions actually called which while your code runs (typically the test suite) and merges the observations into the graph as `CALLS` edges with dynamic provenance: `dynamic: true`, observed call counts, the workloads (tests) that exercised each edge, and `static_missed: true` where no static edge existed.
+
+Index the repository first (`cgr start --repo-path ./my-project --update-graph`), then:
+
+**Python** (a pytest plugin ships with the package, inert unless enabled):
+
+```bash
+cd ./my-project
+pytest --cgr-trace                              # writes cgr-trace.jsonl
+cgr trace ingest cgr-trace.jsonl --repo-path .  # merge into the graph
+```
+
+**Node.js / TypeScript** (V8's built-in profiler, no agent needed; source maps are followed back to the original TypeScript):
+
+```bash
+node --cpu-prof --cpu-prof-name=run.cpuprofile app.js
+cgr trace convert run.cpuprofile --repo-path ./my-project --workload smoke
+cgr trace ingest cgr-trace.jsonl --repo-path ./my-project
+```
+
+**Production overlay** (eBPF continuous profilers: Parca, Pyroscope, OpenTelemetry). Fetch a pprof over HTTP and convert it in one step, re-anchoring build paths to your checkout:
+
+```bash
+cgr trace pull "https://parca.example/query?...&format=pprof" \
+    --repo-path ./my-project --language go \
+    --path-map /build/src/=./my-project/src/ \
+    --label endpoint --header "Authorization=Bearer $TOKEN"
+cgr trace ingest cgr-trace.jsonl --repo-path ./my-project
+```
+
+The JVM (Java, Scala), .NET, PHP, Lua, Dart, Go, Rust, and C/C++ each have a recording recipe in the [Dynamic Call Tracing guide](https://docs.code-graph-rag.com/guide/dynamic-tracing/). Ingest is idempotent, so a cron'd `pull` plus `ingest` keeps a continuously refreshing production overlay. The absence of a dynamic edge never means dead code; it only means the traced workload did not exercise that path.
+
 ## MCP Server
 
 Run `cgr mcp-server` to serve the tools over stdio or HTTP for Claude Code and other MCP clients. The MCP surface registers:

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/README.md

@@ -1,12 +1,13 @@
 <div align="center">
-  <!-- Bitbucket strips <picture>/<source> tags, so we use a single light-mode <img>. Restore the theme-aware <picture> block below when the GitHub account is reinstated:
   <picture>
-    <source srcset="assets/logo-dark-any.png" media="(prefers-color-scheme: dark)">
-    <source srcset="assets/logo-light-any.png" media="(prefers-color-scheme: light)">
-    <img src="assets/logo-dark-any.png" alt="Code-Graph-RAG Logo" width="480">
+    <source media="(prefers-color-scheme: dark)" srcset="assets/logo-dark-any.png">
+    <source media="(prefers-color-scheme: light)" srcset="assets/logo-light-any.png">
+    <img src="assets/logo-light-any.png" alt="Code-Graph-RAG Logo" width="480">
   </picture>
-  -->
-  <img src="assets/logo-light-any.png" alt="Code-Graph-RAG Logo" width="480">
+
+  <p>
+    <a href="https://trendshift.io/repositories/99619" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/99619" alt="vitali87/code-graph-rag | Trendshift" width="250" height="55"/></a>
+  </p>
 
   <p>
   <!-- Badges below are commented out while the GitHub account is suspended. Restore them when the account is reinstated.
@@ -71,9 +72,9 @@ Code-Graph-RAG parses a multi-language codebase with Tree-sitter, builds a knowl
 ## Latest News 🔥
 
 <!-- SECTION:latest_news -->
+- **Runtime Call Tracing**: A dynamic tracer runs your code (typically the test suite) and merges the calls that actually happened into the graph as `CALLS` edges (flagged where static analysis missed them), so dispatch through interfaces, virtual methods, function pointers, reflection, and framework routing becomes visible. Convert a run from Python, the JVM, Node.js, .NET, PHP, Lua, Dart, Go, Rust, or C/C++ with `cgr trace`, or ingest production pprof profiles from an eBPF continuous profiler (Parca, Pyroscope, OpenTelemetry) with `cgr trace convert --format ebpf`.
 - **Ruby Support**: Ruby joins the graph through a new pluggable ast-grep tier that adds a language from a single YAML pattern file, emitting `Module`, `Function`, and `Class` nodes plus import edges without a hand-written parser.
 - **Structural Search & Replace**: Find and rewrite code by AST pattern with ast-grep, exposed as agent tools so you can match and transform structure across the whole codebase instead of relying on text or regex.
-- **Data-Flow Tracing**: New `FLOWS_TO` taint edges follow values through assignments, function calls, and I/O sinks, with coverage across C#, Java, C, and Go.
 <!-- /SECTION:latest_news -->
 
 See [NEWS.md](NEWS.md) for the full history.
@@ -88,6 +89,7 @@ Point Code-Graph-RAG at a repository and it reads every source file, extracts fu
 - Optimise code against language best practices or your own coding standards.
 - Find dead code by walking call and reference edges from entry points.
 - Search and rewrite structurally by AST pattern with ast-grep.
+- Overlay runtime behaviour: trace a test run (or pull production eBPF profiles) with `cgr trace` and merge the calls that actually happened into the graph, exposing dispatch that static analysis cannot see.
 
 ## How It Works
 
@@ -157,6 +159,7 @@ Code-Graph-RAG runs as an [MCP](https://modelcontextprotocol.io) server so Claud
 - [Interactive Querying](docs/guide/interactive-querying.md)
 - [Code Optimisation](docs/guide/code-optimization.md)
 - [Dead Code Detection](docs/guide/dead-code.md)
+- [Dynamic Call Tracing](docs/guide/dynamic-tracing.md)
 - [Graph Export](docs/guide/graph-export.md)
 - [Real-Time Updates](docs/guide/realtime-updates.md)
 - [MCP Server](docs/guide/mcp-server.md)

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662/code_graph_rag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-graph-rag
-Version: 0.0.589
+Version: 0.0.662
 Summary: The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
 License-Expression: MIT
 Keywords: rag,retrieval-augmented-generation,knowledge-graph,code-analysis,tree-sitter,mcp,mcp-server,llm,graph-database,semantic-search,codebase,memgraph,developer-tools,monorepo
@@ -33,11 +33,12 @@ Requires-Dist: typer>=0.21.1
 Requires-Dist: rich>=14.2.0
 Requires-Dist: prompt-toolkit>=3.0.52
 Requires-Dist: diff-match-patch>=20241021
-Requires-Dist: click>=8.3.1
+Requires-Dist: click>=8.3.3
 Requires-Dist: protobuf>=6.33.5
 Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: huggingface-hub[hf-xet]>=1.7.2
 Requires-Dist: pathspec>=1.0.4
+Requires-Dist: pygments>=2.20.0
 Provides-Extra: test
 Requires-Dist: pytest>=8.4.1; extra == "test"
 Requires-Dist: pytest-asyncio>=1.0.0; extra == "test"
@@ -88,6 +89,7 @@ Point it at a repository and it reads every source file, extracts functions, cla
 - Trace data flow through assignments, calls, and I/O sinks via `FLOWS_TO` taint edges.
 - Optimise code against language best practices or your own coding standards.
 - Find dead code by walking call and reference edges from entry points.
+- Overlay runtime behaviour: trace a test run (or pull production eBPF profiles) and merge the calls that actually happened into the graph, exposing dispatch that static analysis cannot see.
 - Group several repositories into a named workspace and query them as one graph.
 - Trace calls between microservices: route decorators become endpoint templates, and HTTP client URLs resolve to the handlers that serve them, linking services across project boundaries.
 
@@ -188,6 +190,40 @@ cgr status                                 # stack state and last sync per proje
 cgr doctor                                 # check dependencies and configuration
 ```
 
+## Runtime Call Tracing
+
+Static analysis cannot see calls through interfaces, reflection, registries, or framework routing. `cgr trace` records which functions actually called which while your code runs (typically the test suite) and merges the observations into the graph as `CALLS` edges with dynamic provenance: `dynamic: true`, observed call counts, the workloads (tests) that exercised each edge, and `static_missed: true` where no static edge existed.
+
+Index the repository first (`cgr start --repo-path ./my-project --update-graph`), then:
+
+**Python** (a pytest plugin ships with the package, inert unless enabled):
+
+```bash
+cd ./my-project
+pytest --cgr-trace                              # writes cgr-trace.jsonl
+cgr trace ingest cgr-trace.jsonl --repo-path .  # merge into the graph
+```
+
+**Node.js / TypeScript** (V8's built-in profiler, no agent needed; source maps are followed back to the original TypeScript):
+
+```bash
+node --cpu-prof --cpu-prof-name=run.cpuprofile app.js
+cgr trace convert run.cpuprofile --repo-path ./my-project --workload smoke
+cgr trace ingest cgr-trace.jsonl --repo-path ./my-project
+```
+
+**Production overlay** (eBPF continuous profilers: Parca, Pyroscope, OpenTelemetry). Fetch a pprof over HTTP and convert it in one step, re-anchoring build paths to your checkout:
+
+```bash
+cgr trace pull "https://parca.example/query?...&format=pprof" \
+    --repo-path ./my-project --language go \
+    --path-map /build/src/=./my-project/src/ \
+    --label endpoint --header "Authorization=Bearer $TOKEN"
+cgr trace ingest cgr-trace.jsonl --repo-path ./my-project
+```
+
+The JVM (Java, Scala), .NET, PHP, Lua, Dart, Go, Rust, and C/C++ each have a recording recipe in the [Dynamic Call Tracing guide](https://docs.code-graph-rag.com/guide/dynamic-tracing/). Ingest is idempotent, so a cron'd `pull` plus `ingest` keeps a continuously refreshing production overlay. The absence of a dynamic edge never means dead code; it only means the traced workload did not exercise that path.
+
 ## MCP Server
 
 Run `cgr mcp-server` to serve the tools over stdio or HTTP for Claude Code and other MCP clients. The MCP surface registers:

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/code_graph_rag.egg-info/SOURCES.txt

@@ -117,6 +117,7 @@ codebase_rag/constants/providers.py
 codebase_rag/constants/security.py
 codebase_rag/constants/stdlib_types.py
 codebase_rag/constants/structural.py
+codebase_rag/constants/trace.py
 codebase_rag/mcp/__init__.py
 codebase_rag/mcp/client.py
 codebase_rag/mcp/server.py
@@ -139,6 +140,7 @@ codebase_rag/parsers/function_ingest.py
 codebase_rag/parsers/import_processor.py
 codebase_rag/parsers/python_source_roots.py
 codebase_rag/parsers/rpc_exposure.py
+codebase_rag/parsers/semantic_call_join.py
 codebase_rag/parsers/stdlib_extractor.py
 codebase_rag/parsers/structure_processor.py
 codebase_rag/parsers/type_inference.py
@@ -175,10 +177,20 @@ codebase_rag/parsers/dart/utils.py
 codebase_rag/parsers/flow_access/__init__.py
 codebase_rag/parsers/flow_access/constants.py
 codebase_rag/parsers/flow_access/processor.py
+codebase_rag/parsers/frontends/__init__.py
+codebase_rag/parsers/frontends/csharp.py
+codebase_rag/parsers/frontends/go.py
+codebase_rag/parsers/frontends/protocol.py
+codebase_rag/parsers/frontends/registry.py
 codebase_rag/parsers/go/__init__.py
 codebase_rag/parsers/go/module_paths.py
 codebase_rag/parsers/go/type_inference.py
 codebase_rag/parsers/go/utils.py
+codebase_rag/parsers/go_frontend/__init__.py
+codebase_rag/parsers/go_frontend/frontend.py
+codebase_rag/parsers/go_frontend/gotypes/go.mod
+codebase_rag/parsers/go_frontend/gotypes/go.sum
+codebase_rag/parsers/go_frontend/gotypes/main.go
 codebase_rag/parsers/handlers/__init__.py
 codebase_rag/parsers/handlers/base.py
 codebase_rag/parsers/handlers/cpp.py
@@ -253,6 +265,21 @@ codebase_rag/tools/structural_editor.py
 codebase_rag/tools/structural_search.py
 codebase_rag/tools/tool_descriptions.py
 codebase_rag/tools/web_search.py
+codebase_rag/trace/__init__.py
+codebase_rag/trace/cli.py
+codebase_rag/trace/cpuprofile.py
+codebase_rag/trace/ebpf_pprof.py
+codebase_rag/trace/ingest.py
+codebase_rag/trace/instrumented.py
+codebase_rag/trace/pprof.py
+codebase_rag/trace/pytest_plugin.py
+codebase_rag/trace/records.py
+codebase_rag/trace/resolution.py
+codebase_rag/trace/rust_pprof.py
+codebase_rag/trace/sourcemap.py
+codebase_rag/trace/speedscope.py
+codebase_rag/trace/tracer.py
+codebase_rag/trace/xdebug.py
 codebase_rag/utils/__init__.py
 codebase_rag/utils/dependencies.py
 codebase_rag/utils/fqn_resolver.py

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/code_graph_rag.egg-info/entry_points.txt

@@ -1,3 +1,6 @@
 [console_scripts]
 cgr = codebase_rag.cli:app
 code-graph-rag = codebase_rag.cli:app
+
+[pytest11]
+cgr_trace = codebase_rag.trace.pytest_plugin

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/code_graph_rag.egg-info/requires.txt

@@ -13,11 +13,12 @@ typer>=0.21.1
 rich>=14.2.0
 prompt-toolkit>=3.0.52
 diff-match-patch>=20241021
-click>=8.3.1
+click>=8.3.3
 protobuf>=6.33.5
 defusedxml>=0.7.1
 huggingface-hub[hf-xet]>=1.7.2
 pathspec>=1.0.4
+pygments>=2.20.0
 
 [ast-grep]
 ast-grep-py>=0.44.0

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/cli.py

@@ -45,6 +45,7 @@ from .stack.constants import StackState
 from .stack.manager import StackError
 from .tools.health_checker import HealthChecker
 from .tools.language import cli as language_cli
+from .trace.cli import cli as trace_cli
 from .types_defs import DeadCodeConfig, DeadCodeRow, ResultRow
 from .utils.path_utils import derive_project_name, resolve_repo_path
 from .vector_store import clear_all_embeddings, delete_project_embeddings
@@ -952,6 +953,18 @@ def workspace_command(ctx: typer.Context) -> None:
     _run_delegated_group(workspace_cli, ctx)
 
 
+@app.command(
+    name=ch.CLICommandName.TRACE,
+    help=ch.CMD_TRACE,
+    short_help=ch.CMD_TRACE,
+    add_help_option=False,
+    context_settings=_DELEGATED_GROUP_CONTEXT,
+    rich_help_panel=ch.PANEL_GRAPH,
+)
+def trace_command(ctx: typer.Context) -> None:
+    _run_delegated_group(trace_cli, ctx)
+
+
 @app.command(
     name=ch.CLICommandName.HELP,
     help=ch.CMD_HELP,

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/cli_help.py

@@ -15,6 +15,7 @@ class CLICommandName(StrEnum):
     DELETE_PROJECT = "delete-project"
     DAEMON = "daemon"
     WORKSPACE = "workspace"
+    TRACE = "trace"
     STOP = "stop"
     STATUS = "status"
     HELP = "help"
@@ -67,6 +68,11 @@ CMD_WORKSPACE_SHOW = "Show the repositories and project names in a workspace"
 CMD_WORKSPACE_ADD_REPO = "Add a repository to a workspace"
 CMD_WORKSPACE_REMOVE_REPO = "Remove a repository from a workspace by path"
 
+CMD_TRACE = "Ingest runtime call traces as dynamic CALLS edges"
+CMD_TRACE_GROUP = CMD_TRACE
+CMD_TRACE_INGEST = "Resolve a trace file against a project and write dynamic edges"
+CMD_TRACE_CONVERT = "Convert a V8 .cpuprofile (node --cpu-prof) to a trace file"
+
 CMD_STOP = "Stop the shared stack (alias for cgr daemon down)"
 CMD_STATUS = "Show stack state and the last sync time for each project"
 
@@ -94,6 +100,105 @@ EXAMPLES_HELP = "EXAMPLES\n\n  cgr help start\n\n  cgr help daemon logs"
 EPILOG_LANGUAGE = "Run 'cgr help language COMMAND' for command-specific help."
 EPILOG_DAEMON = "Run 'cgr help daemon COMMAND' for command-specific help."
 EPILOG_WORKSPACE = "Run 'cgr help workspace COMMAND' for command-specific help."
+EPILOG_TRACE = "Run 'cgr help trace COMMAND' for command-specific help."
+
+HELP_TRACE_REPO_PATH = (
+    "Repository the trace was recorded against. Used to derive the project "
+    "name and re-anchor traced file paths."
+)
+HELP_TRACE_PROJECT_NAME = (
+    "Project name to ingest into. Defaults to the name derived from --repo-path."
+)
+EXAMPLES_TRACE_INGEST = (
+    "EXAMPLE\n\n  pytest --cgr-trace\n\n"
+    "  cgr trace ingest cgr-trace.jsonl --repo-path ./my-repo"
+)
+HELP_TRACE_OUTPUT = "Where to write the converted trace file."
+HELP_TRACE_WORKLOAD = "Workload label to attach to every converted record."
+HELP_TRACE_INCLUDE = (
+    "Comma-separated namespace prefixes to keep (dotnet-trace speedscope "
+    "profiles carry no file paths, so scoping is by name)."
+)
+HELP_TRACE_LANGUAGE = (
+    "Override the auto-detected source language. Rust pprof profiles share Go's "
+    "gzipped-protobuf format, so pass 'rust' to demangle them as Rust."
+)
+HELP_TRACE_FORMAT = (
+    "Force a profile format instead of auto-detecting it. Use 'ebpf' for pprof "
+    "profiles from an eBPF continuous profiler (Parca, Pyroscope, OTel, perf)."
+)
+HELP_TRACE_PATH_MAP = (
+    "Re-anchor a production build path to the repo, as BUILD_PREFIX=REPO_PREFIX. "
+    "Repeatable; applied before the in-repo check (ebpf format)."
+)
+HELP_TRACE_BUILD_ID = (
+    "Keep only frames from the mapping with this build id or binary filename "
+    "(ebpf format); other binaries are seen through."
+)
+HELP_TRACE_SERVICE = (
+    "Keep only samples whose label matches, as KEY=VALUE (ebpf format)."
+)
+HELP_TRACE_LABEL = (
+    "Sample label whose value becomes each edge's workload (ebpf format)."
+)
+HELP_TRACE_COMMIT = (
+    "The commit the profiled binary was built from; warns if it differs from "
+    "the repository HEAD at convert time (ebpf format)."
+)
+CMD_TRACE_PULL = (
+    "Download a pprof profile from an eBPF continuous profiler over HTTP and "
+    "convert it (Parca download, Pyroscope render?format=pprof, or any URL)."
+)
+HELP_TRACE_PULL_SAVE = (
+    "Keep the downloaded pprof at this path; by default it is removed after conversion."
+)
+HELP_TRACE_PULL_HEADER = (
+    "Extra HTTP request header as NAME=VALUE (e.g. Authorization=Bearer TOKEN); "
+    "repeatable."
+)
+HELP_TRACE_PULL_TIMEOUT = "HTTP request timeout in seconds (default 60)."
+ERR_TRACE_PULL_BAD_URL = "Unsupported URL {url}; expected an http:// or https:// URL."
+# The header value can be a bearer token, so it is never echoed back.
+ERR_TRACE_PULL_BAD_HEADER = (
+    "Invalid --header; expected NAME=VALUE (for example Authorization=Bearer TOKEN)."
+)
+ERR_TRACE_PULL_FAILED = "Could not download {url}: {error}."
+ERR_TRACE_PULL_TOO_LARGE = (
+    "Profile at {url} exceeds the maximum download size (256 MB)."
+)
+ERR_TRACE_PULL_SAVE_EQUALS_OUTPUT = (
+    "--save and --output must be different paths (--output holds the converted "
+    "trace, --save the downloaded profile)."
+)
+EXAMPLES_TRACE_PULL = (
+    "EXAMPLE\n\n"
+    "  cgr trace pull https://parca.example/api/... \\\n"
+    "      --repo-path ./my-repo --build-id 8f3a \\\n"
+    "      --path-map /build/src/=./my-repo/src/ \\\n"
+    "      --header Authorization=Bearer $TOKEN\n\n"
+    "  cgr trace ingest cgr-trace.jsonl --repo-path ./my-repo"
+)
+ERR_TRACE_CONVERT_BAD_FORMAT = "Unknown --format '{format}'; supported: ebpf."
+ERR_TRACE_CONVERT_BAD_PATH_MAP = (
+    "Invalid --path-map '{value}'; expected BUILD_PREFIX=REPO_PREFIX."
+)
+ERR_TRACE_CONVERT_BAD_SERVICE = "Invalid --service '{value}'; expected KEY=VALUE."
+MSG_TRACE_COMMIT_MISMATCH = (
+    "Profiled commit {profiled} differs from repository HEAD {head}; edges may "
+    "resolve against moved or renamed code."
+)
+ERR_TRACE_CONVERT_BAD_LANGUAGE = (
+    "Unknown --language '{language}'; supported override values: {supported}."
+)
+ERR_TRACE_CONVERT_NEEDS_REPO = "V8 cpuprofiles need --repo-path to scope frames."
+ERR_TRACE_CONVERT_NEEDS_INCLUDE = (
+    "speedscope profiles need --include namespace prefixes to scope frames."
+)
+EXAMPLES_TRACE_CONVERT = (
+    "EXAMPLE\n\n  node --cpu-prof --cpu-prof-name=run.cpuprofile app.js\n\n"
+    "  cgr trace convert run.cpuprofile --repo-path ./my-repo\n\n"
+    "  cgr trace ingest cgr-trace.jsonl --repo-path ./my-repo"
+)
 
 HELP_WORKSPACE_DESCRIPTION = "Optional short description for the workspace."
 HELP_WORKSPACE_FORCE = "Overwrite an existing workspace with the same name."
@@ -235,6 +340,7 @@ CLI_COMMANDS: dict[CLICommandName, str] = {
     CLICommandName.DELETE_PROJECT: CMD_DELETE_PROJECT,
     CLICommandName.LANGUAGE: CMD_LANGUAGE,
     CLICommandName.DAEMON: CMD_DAEMON,
+    CLICommandName.TRACE: CMD_TRACE,
     CLICommandName.WORKSPACE: CMD_WORKSPACE,
     CLICommandName.STOP: CMD_STOP,
     CLICommandName.STATUS: CMD_STATUS,

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/config.py

@@ -17,7 +17,11 @@ from . import exceptions as ex
 from . import logs
 from .types_defs import CgrignorePatterns, ModelConfigKwargs
 
-load_dotenv()
+# Load only the configuration file in the invocation directory.  The default
+# python-dotenv discovery walks parent directories, which can silently import
+# credentials from an unrelated workspace (and makes tests depend on the
+# caller's directory layout).
+load_dotenv(dotenv_path=Path.cwd() / ".env")
 
 
 class ApiKeyInfoEntry(TypedDict):
@@ -200,7 +204,14 @@ class AppConfig(BaseSettings):
     # HYBRID needs a dotnet SDK + a restorable .csproj/.sln and degrades without
     # them. HYBRID augments (base-vs-interface, overload and extension binding,
     # partial-class identity); tree-sitter stays the standalone-correct backbone.
-    CSHARP_FRONTEND: cs.CSharpFrontend = cs.CSharpFrontend.AUTO
+    # Default to tree-sitter so indexing an untrusted repository never auto-invokes
+    # MSBuild/Roslyn; opt into AUTO/HYBRID/ROSLYN explicitly (security, #1231).
+    CSHARP_FRONTEND: cs.CSharpFrontend = cs.CSharpFrontend.TREESITTER
+    # Opt-in go/packages semantic layer for Go (issue #1179). AUTO uses it where a
+    # go toolchain is on PATH and degrades to pure tree-sitter otherwise. GOTYPES
+    # augments exact first-party call binding and external-site suppression;
+    # tree-sitter stays the standalone-correct backbone.
+    GO_FRONTEND: cs.GoFrontend = cs.GoFrontend.AUTO
     CAPTURE_FUNCTION_LOCAL_DEFINITIONS: bool = Field(
         True, validation_alias="CGR_CAPTURE_LOCAL_DEFINITIONS"
     )
@@ -238,35 +249,18 @@ class AppConfig(BaseSettings):
             "tee",
         }
     )
+    # Only commands that cannot accept filesystem paths are approval-free.
+    # Filesystem and Git reads require approval because their path syntaxes can
+    # escape the project root (absolute paths, traversal, symlinks, git -C, and
+    # --git-dir). Project-confined read/search tools should be preferred instead.
     SHELL_READ_ONLY_COMMANDS: frozenset[str] = frozenset(
         {
-            "ls",
-            "cat",
-            "find",
             "pwd",
-            "rg",
             "echo",
-            "wc",
-            "head",
-            "tail",
-            "sort",
-            "uniq",
-            "cut",
             "tr",
         }
     )
-    SHELL_SAFE_GIT_SUBCOMMANDS: frozenset[str] = frozenset(
-        {
-            "status",
-            "log",
-            "diff",
-            "show",
-            "ls-files",
-            "remote",
-            "config",
-            "branch",
-        }
-    )
+    SHELL_SAFE_GIT_SUBCOMMANDS: frozenset[str] = frozenset()
 
     QDRANT_DB_PATH: str = "./.qdrant_code_embeddings"
     QDRANT_URL: str | None = None

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/constants/__init__.py

@@ -28,3 +28,4 @@ from .providers import *  # noqa: F403
 from .security import *  # noqa: F403
 from .stdlib_types import *  # noqa: F403
 from .structural import *  # noqa: F403
+from .trace import *  # noqa: F403

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/constants/ast_cpp.py

@@ -18,6 +18,7 @@ class CppNodeType(StrEnum):
     TEMPLATE_DECLARATION = "template_declaration"
     CLASS_SPECIFIER = "class_specifier"
     FUNCTION_DECLARATOR = "function_declarator"
+    VARIADIC_PARAMETER = "variadic_parameter"
     POINTER_DECLARATOR = "pointer_declarator"
     REFERENCE_DECLARATOR = "reference_declarator"
     # An attribute MACRO before a definition (`JSON_HEDLEY_NON_NULL(3)

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/constants/ast_dart.py

@@ -80,6 +80,23 @@ TS_DART_INITIALIZED_IDENTIFIER = "initialized_identifier"
 TS_DART_INITIALIZED_VARIABLE_DEFINITION = "initialized_variable_definition"
 TS_DART_FORMAL_PARAMETER = "formal_parameter"
 
+# FLOWS_TO lean-walk node types (issue #1173). Dart has no call-expression node:
+# calls/members/bindings are flat sibling `selector` chains reconstructed by the
+# dart/utils.py helpers (dart_call_name, dart_member_read_name, dart_body_node).
+TS_DART_STRING_LITERAL = "string_literal"
+TS_DART_INDEX_SELECTOR = "index_selector"
+TS_DART_ASSIGNMENT_EXPRESSION = "assignment_expression"
+TS_DART_EXPRESSION_STATEMENT = "expression_statement"
+TS_DART_LOCAL_VARIABLE_DECLARATION = "local_variable_declaration"
+TS_DART_ASSIGNABLE_EXPRESSION = "assignable_expression"
+TS_DART_FORMAL_PARAMETER_LIST = "formal_parameter_list"
+TS_DART_SWITCH_STATEMENT_CASE = "switch_statement_case"
+TS_DART_SWITCH_STATEMENT_DEFAULT = "switch_statement_default"
+TS_DART_TEMPLATE_SUBSTITUTION = "template_substitution"
+# `[String m]` (optional positional) and `{String? m}` (named) both wrap their
+# `formal_parameter`s in an `optional_formal_parameters` node (issue #1173).
+TS_DART_OPTIONAL_FORMAL_PARAMETERS = "optional_formal_parameters"
+
 # Type/class-like declarations (all captured as @class)
 TS_DART_CLASS_DEFINITION = "class_definition"
 TS_DART_MIXIN_DECLARATION = "mixin_declaration"

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/constants/ast_go.py

@@ -20,6 +20,7 @@ TS_GO_FIELD_DECLARATION = "field_declaration"
 TS_GO_FIELD_IDENTIFIER = "field_identifier"
 TS_GO_INTERFACE_TYPE = "interface_type"
 TS_GO_PARAMETER_DECLARATION = "parameter_declaration"
+TS_GO_VARIADIC_PARAMETER_DECLARATION = "variadic_parameter_declaration"
 TS_GO_FUNC_LITERAL = "func_literal"
 TS_GO_SOURCE_FILE = "source_file"
 TS_GO_FUNCTION_DECLARATION = "function_declaration"

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/constants/ast_js.py

@@ -84,6 +84,9 @@ TS_GET_ACCESSOR_KEYWORD = "get"
 TS_ARROW_FUNCTION = "arrow_function"
 TS_REQUIRED_PARAMETER = "required_parameter"
 TS_OPTIONAL_PARAMETER = "optional_parameter"
+# TypeScript `this` pseudo-parameter (`function f(this: T, ...)`): a type-only
+# annotation, not a runtime argument, so it occupies no positional slot.
+TS_THIS_PARAMETER = "this"
 TS_ASSIGNMENT_PATTERN = "assignment_pattern"
 TS_JS_ASSIGNMENT_EXPRESSION = "assignment_expression"
 # A class field holding a value (`log = noop`); `name` is the property, `value`

{code_graph_rag-0.0.589 → code_graph_rag-0.0.662}/codebase_rag/constants/ast_lua.py

@@ -5,6 +5,7 @@ from .ast_nodes import TS_STRING, TS_STRING_LITERAL
 LUA_STRING_TYPES = (TS_STRING, TS_STRING_LITERAL)
 
 TS_DOT_INDEX_EXPRESSION = "dot_index_expression"
+TS_LUA_BRACKET_INDEX_EXPRESSION = "bracket_index_expression"
 TS_LUA_VARIABLE_DECLARATION = "variable_declaration"
 TS_LUA_ASSIGNMENT_STATEMENT = "assignment_statement"
 TS_LUA_VARIABLE_LIST = "variable_list"
@@ -12,6 +13,11 @@ TS_LUA_EXPRESSION_LIST = "expression_list"
 TS_LUA_FUNCTION_CALL = "function_call"
 TS_LUA_METHOD_INDEX_EXPRESSION = "method_index_expression"
 TS_LUA_IDENTIFIER = "identifier"
+TS_LUA_STRING_CONTENT = "string_content"
+TS_LUA_BLOCK = "block"
+# `dot_index_expression` / `bracket_index_expression` field names: the accessed
+# table is `table`, the member/key is `field`.
+TS_LUA_FIELD_TABLE = "table"
 TS_LUA_LOCAL_STATEMENT = "local_statement"
 LUA_STATEMENT_SUFFIX = "statement"
 LUA_DEFAULT_VAR_TYPES = (TS_LUA_IDENTIFIER,)