code-graph-rag 0.0.670__tar.gz → 0.0.720__tar.gz

{code_graph_rag-0.0.670/code_graph_rag.egg-info → code_graph_rag-0.0.720}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-graph-rag
-Version: 0.0.670
+Version: 0.0.720
 Summary: The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
 License-Expression: MIT
 Keywords: rag,retrieval-augmented-generation,knowledge-graph,code-analysis,tree-sitter,mcp,mcp-server,llm,graph-database,semantic-search,codebase,memgraph,developer-tools,monorepo
@@ -40,6 +40,7 @@ Requires-Dist: huggingface-hub[hf-xet]>=1.7.2
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: pygments>=2.20.0
 Provides-Extra: test
+Requires-Dist: jedi>=0.19; extra == "test"
 Requires-Dist: pytest>=8.4.1; extra == "test"
 Requires-Dist: pytest-asyncio>=1.0.0; extra == "test"
 Requires-Dist: pytest-cov>=4.0.0; extra == "test"
@@ -49,6 +50,8 @@ Requires-Dist: libclang>=18.1.1; extra == "test"
 Requires-Dist: filelock>=3.12; extra == "test"
 Requires-Dist: ast-grep-py>=0.44.0; extra == "test"
 Requires-Dist: pyyaml>=6.0; extra == "test"
+Provides-Extra: cpp
+Requires-Dist: libclang>=18.1.1; extra == "cpp"
 Provides-Extra: treesitter-full
 Requires-Dist: tree-sitter-python>=0.23.6; extra == "treesitter-full"
 Requires-Dist: tree-sitter-javascript>=0.23.1; extra == "treesitter-full"
@@ -72,6 +75,8 @@ Requires-Dist: pymilvus[milvus-lite]>=3.0.0; extra == "milvus"
 Provides-Extra: ast-grep
 Requires-Dist: ast-grep-py>=0.44.0; extra == "ast-grep"
 Requires-Dist: pyyaml>=6.0; extra == "ast-grep"
+Provides-Extra: python-semantics
+Requires-Dist: jedi>=0.19; extra == "python-semantics"
 Dynamic: license-file
 
 # Code-Graph-RAG
@@ -95,7 +100,7 @@ Point it at a repository and it reads every source file, extracts functions, cla
 
 ## Supported Languages
 
-Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby has structural support (modules, functions, classes, and imports) through the pluggable ast-grep tier, which requires the `ast-grep` extra (`pip install 'code-graph-rag[ast-grep]'`).
+Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby, Kotlin, Swift, Elixir, Haskell, Solidity, Bash, and Nix have structural support (modules, functions, classes where the language has them, and imports) through the pluggable ast-grep tier, which requires the `ast-grep` extra (`pip install 'code-graph-rag[ast-grep]'`).
 
 ## Install
 
@@ -125,6 +130,20 @@ instead of locally, set `CGR_EMBEDDING_PROVIDER=openai` with
 `OPENAI_EMBEDDING_BASE_URL` and `OPENAI_EMBEDDING_MODEL`; torch and
 transformers are then not required locally.
 
+### Which version am I getting?
+
+`pip install code-graph-rag` gives you the newest PyPI release, which is deliberately
+not the newest commit. Git tags exist for every version (one per merge), while PyPI
+uploads and GitHub Release binaries land on an every-50 cadence, so the tag on `main`
+usually runs ahead of the published version. A security fix is the exception: it
+ships immediately rather than waiting for the cadence.
+
+To run code newer than the latest release, install from git:
+
+```bash
+pip install "code-graph-rag[treesitter-full] @ git+https://github.com/vitali87/code-graph-rag@main"
+```
+
 ### Prerequisites
 
 - Python 3.12+

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/PYPI_README.md

@@ -19,7 +19,7 @@ Point it at a repository and it reads every source file, extracts functions, cla
 
 ## Supported Languages
 
-Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby has structural support (modules, functions, classes, and imports) through the pluggable ast-grep tier, which requires the `ast-grep` extra (`pip install 'code-graph-rag[ast-grep]'`).
+Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby, Kotlin, Swift, Elixir, Haskell, Solidity, Bash, and Nix have structural support (modules, functions, classes where the language has them, and imports) through the pluggable ast-grep tier, which requires the `ast-grep` extra (`pip install 'code-graph-rag[ast-grep]'`).
 
 ## Install
 
@@ -49,6 +49,20 @@ instead of locally, set `CGR_EMBEDDING_PROVIDER=openai` with
 `OPENAI_EMBEDDING_BASE_URL` and `OPENAI_EMBEDDING_MODEL`; torch and
 transformers are then not required locally.
 
+### Which version am I getting?
+
+`pip install code-graph-rag` gives you the newest PyPI release, which is deliberately
+not the newest commit. Git tags exist for every version (one per merge), while PyPI
+uploads and GitHub Release binaries land on an every-50 cadence, so the tag on `main`
+usually runs ahead of the published version. A security fix is the exception: it
+ships immediately rather than waiting for the cadence.
+
+To run code newer than the latest release, install from git:
+
+```bash
+pip install "code-graph-rag[treesitter-full] @ git+https://github.com/vitali87/code-graph-rag@main"
+```
+
 ### Prerequisites
 
 - Python 3.12+

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/README.md

@@ -10,17 +10,6 @@
   </p>
 
   <p>
-  <!-- Badges below are commented out while the GitHub account is suspended. Restore them when the account is reinstated.
-       Stars/Forks: shields.io hits GitHub's API (returns "repo not found" for suspended accounts).
-       gitcgr: indexes from GitHub (shows "not indexed" while unavailable).
-       MseeP.ai: badge PNG ignores inline height on Bitbucket and renders as a full-size tile.
-  <a href="https://github.com/vitali87/code-graph-rag/stargazers">
-    <img src="https://img.shields.io/github/stars/vitali87/code-graph-rag?style=social" alt="GitHub stars" />
-  </a>
-  <a href="https://github.com/vitali87/code-graph-rag/network/members">
-    <img src="https://img.shields.io/github/forks/vitali87/code-graph-rag?style=social" alt="GitHub forks" />
-  </a>
-  -->
   <a href="https://github.com/vitali87/code-graph-rag/actions/workflows/ci.yml">
     <img src="https://img.shields.io/github/actions/workflow/status/vitali87/code-graph-rag/ci.yml?branch=main" alt="CI" />
   </a>
@@ -30,11 +19,6 @@
   <a href="https://sonarcloud.io/summary/overall?id=vitali87_code-graph-rag">
     <img src="https://sonarcloud.io/api/project_badges/measure?project=vitali87_code-graph-rag&metric=alert_status" alt="Quality Gate Status" />
   </a>
-  <!--
-  <a href="https://mseep.ai/app/vitali87-code-graph-rag">
-    <img src="https://mseep.net/pr/vitali87-code-graph-rag-badge.png" alt="MseeP.ai Security Assessment" height="20" />
-  </a>
-  -->
   <a href="https://code-graph-rag.com">
     <img src="https://img.shields.io/badge/Enterprise-Support%20%26%20Services-6366f1" alt="Enterprise Support" />
   </a>
@@ -53,11 +37,6 @@
   <a href="https://www.bestpractices.dev/projects/13757">
     <img src="https://www.bestpractices.dev/projects/13757/badge" alt="OpenSSF Best Practices" />
   </a>
-  <!--
-  <a href="https://gitcgr.com/vitali87/code-graph-rag">
-    <img src="https://gitcgr.com/badge/vitali87/code-graph-rag.svg" alt="gitcgr" />
-  </a>
-  -->
 </p>
 </div>
 
@@ -72,9 +51,9 @@ Code-Graph-RAG parses a multi-language codebase with Tree-sitter, builds a knowl
 ## Latest News 🔥
 
 <!-- SECTION:latest_news -->
-- **Runtime Call Tracing**: A dynamic tracer runs your code (typically the test suite) and merges the calls that actually happened into the graph as `CALLS` edges (flagged where static analysis missed them), so dispatch through interfaces, virtual methods, function pointers, reflection, and framework routing becomes visible. Convert a run from Python, the JVM, Node.js, .NET, PHP, Lua, Dart, Go, Rust, or C/C++ with `cgr trace`, or ingest production pprof profiles from an eBPF continuous profiler (Parca, Pyroscope, OpenTelemetry) with `cgr trace convert --format ebpf`.
-- **Ruby Support**: Ruby joins the graph through a new pluggable ast-grep tier that adds a language from a single YAML pattern file, emitting `Module`, `Function`, and `Class` nodes plus import edges without a hand-written parser.
-- **Structural Search & Replace**: Find and rewrite code by AST pattern with ast-grep, exposed as agent tools so you can match and transform structure across the whole codebase instead of relying on text or regex.
+- **Language Support**: The system now supports Ruby, bringing enhanced code analysis capabilities to your Ruby projects.
+- **Structural Analysis**: You can now find and rewrite code based on AST patterns using structural search and replace.
+- **Data Flow Tracking**: Enhanced data-flow tracing is now available for C#, Java, C, and Go, providing more comprehensive visibility into data movement.
 <!-- /SECTION:latest_news -->
 
 See [NEWS.md](NEWS.md) for the full history.
@@ -108,7 +87,7 @@ See the [Architecture Overview](docs/architecture/overview.md) and [Graph Schema
 
 ## Supported Languages
 
-Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby has structural support (modules, functions, classes, and imports) through the pluggable ast-grep tier. See the [Language Support](docs/architecture/language-support.md) matrix for per-language capabilities.
+Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby, Kotlin, Swift, Elixir, Haskell, Solidity, Bash, and Nix have structural support (modules, functions, classes where the language has them, and imports) through the pluggable ast-grep tier. See the [Language Support](docs/architecture/language-support.md) matrix for per-language capabilities.
 
 ## Installation
 
@@ -122,6 +101,31 @@ uv tool install "code-graph-rag[treesitter-full,semantic]"
 pipx install "code-graph-rag[treesitter-full,semantic]"
 ```
 
+### Which version am I getting?
+
+Three version lines exist and they intentionally differ:
+
+| where | what it tracks |
+|---|---|
+| git tags | every version, one per merge |
+| GitHub Releases (binaries, signatures) | every 50th version, plus any security fix |
+| PyPI | every 50th version, plus any security fix |
+
+So the newest tag on `main` usually runs ahead of the newest release, often by
+tens of patch versions; they coincide only just after a release. Nothing is
+stuck, the cadences differ by design. A security fix does NOT wait for the
+cadence: it ships a release and a PyPI upload immediately.
+
+`uv tool install` and `pipx install` give you the newest PyPI version, which is the
+newest RELEASE, not the newest tag. Interim tags exist so every merge is
+addressable; binaries and PyPI uploads follow the cadence above.
+
+To run code newer than the latest release, install from git:
+
+```bash
+uv tool install "code-graph-rag[treesitter-full,semantic] @ git+https://github.com/vitali87/code-graph-rag@main"
+```
+
 You also need Docker (for Memgraph), `cmake`, and `ripgrep`. Full prerequisites, source installs, and environment setup are in the [Installation](docs/getting-started/installation.md) guide.
 
 ## Quick Start
@@ -162,6 +166,7 @@ Code-Graph-RAG runs as an [MCP](https://modelcontextprotocol.io) server so Claud
 - [Dynamic Call Tracing](docs/guide/dynamic-tracing.md)
 - [Graph Export](docs/guide/graph-export.md)
 - [Real-Time Updates](docs/guide/realtime-updates.md)
+- [C/C++ Semantic Mode](docs/guide/cpp-semantic-mode.md)
 - [MCP Server](docs/guide/mcp-server.md)
 
 **Architecture**

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720/code_graph_rag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-graph-rag
-Version: 0.0.670
+Version: 0.0.720
 Summary: The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
 License-Expression: MIT
 Keywords: rag,retrieval-augmented-generation,knowledge-graph,code-analysis,tree-sitter,mcp,mcp-server,llm,graph-database,semantic-search,codebase,memgraph,developer-tools,monorepo
@@ -40,6 +40,7 @@ Requires-Dist: huggingface-hub[hf-xet]>=1.7.2
 Requires-Dist: pathspec>=1.0.4
 Requires-Dist: pygments>=2.20.0
 Provides-Extra: test
+Requires-Dist: jedi>=0.19; extra == "test"
 Requires-Dist: pytest>=8.4.1; extra == "test"
 Requires-Dist: pytest-asyncio>=1.0.0; extra == "test"
 Requires-Dist: pytest-cov>=4.0.0; extra == "test"
@@ -49,6 +50,8 @@ Requires-Dist: libclang>=18.1.1; extra == "test"
 Requires-Dist: filelock>=3.12; extra == "test"
 Requires-Dist: ast-grep-py>=0.44.0; extra == "test"
 Requires-Dist: pyyaml>=6.0; extra == "test"
+Provides-Extra: cpp
+Requires-Dist: libclang>=18.1.1; extra == "cpp"
 Provides-Extra: treesitter-full
 Requires-Dist: tree-sitter-python>=0.23.6; extra == "treesitter-full"
 Requires-Dist: tree-sitter-javascript>=0.23.1; extra == "treesitter-full"
@@ -72,6 +75,8 @@ Requires-Dist: pymilvus[milvus-lite]>=3.0.0; extra == "milvus"
 Provides-Extra: ast-grep
 Requires-Dist: ast-grep-py>=0.44.0; extra == "ast-grep"
 Requires-Dist: pyyaml>=6.0; extra == "ast-grep"
+Provides-Extra: python-semantics
+Requires-Dist: jedi>=0.19; extra == "python-semantics"
 Dynamic: license-file
 
 # Code-Graph-RAG
@@ -95,7 +100,7 @@ Point it at a repository and it reads every source file, extracts functions, cla
 
 ## Supported Languages
 
-Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby has structural support (modules, functions, classes, and imports) through the pluggable ast-grep tier, which requires the `ast-grep` extra (`pip install 'code-graph-rag[ast-grep]'`).
+Python, TypeScript, TSX, JavaScript, Rust, Go, Java, C, C++, C#, PHP, Lua, and Dart are fully supported. Scala is in development, and Ruby, Kotlin, Swift, Elixir, Haskell, Solidity, Bash, and Nix have structural support (modules, functions, classes where the language has them, and imports) through the pluggable ast-grep tier, which requires the `ast-grep` extra (`pip install 'code-graph-rag[ast-grep]'`).
 
 ## Install
 
@@ -125,6 +130,20 @@ instead of locally, set `CGR_EMBEDDING_PROVIDER=openai` with
 `OPENAI_EMBEDDING_BASE_URL` and `OPENAI_EMBEDDING_MODEL`; torch and
 transformers are then not required locally.
 
+### Which version am I getting?
+
+`pip install code-graph-rag` gives you the newest PyPI release, which is deliberately
+not the newest commit. Git tags exist for every version (one per merge), while PyPI
+uploads and GitHub Release binaries land on an every-50 cadence, so the tag on `main`
+usually runs ahead of the published version. A security fix is the exception: it
+ships immediately rather than waiting for the cadence.
+
+To run code newer than the latest release, install from git:
+
+```bash
+pip install "code-graph-rag[treesitter-full] @ git+https://github.com/vitali87/code-graph-rag@main"
+```
+
 ### Prerequisites
 
 - Python 3.12+

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/code_graph_rag.egg-info/SOURCES.txt

@@ -125,6 +125,7 @@ codebase_rag/mcp/server.py
 codebase_rag/mcp/tools.py
 codebase_rag/parsers/__init__.py
 codebase_rag/parsers/ast_grep_tier.py
+codebase_rag/parsers/build_lock.py
 codebase_rag/parsers/call_processor.py
 codebase_rag/parsers/call_resolver.py
 codebase_rag/parsers/contract_linking.py
@@ -139,6 +140,8 @@ codebase_rag/parsers/export_detection.py
 codebase_rag/parsers/factory.py
 codebase_rag/parsers/function_ingest.py
 codebase_rag/parsers/import_processor.py
+codebase_rag/parsers/java_generated.py
+codebase_rag/parsers/java_lombok.py
 codebase_rag/parsers/python_source_roots.py
 codebase_rag/parsers/rpc_exposure.py
 codebase_rag/parsers/semantic_call_join.py
@@ -146,7 +149,14 @@ codebase_rag/parsers/stdlib_extractor.py
 codebase_rag/parsers/structure_processor.py
 codebase_rag/parsers/type_inference.py
 codebase_rag/parsers/utils.py
+codebase_rag/parsers/ast_grep_patterns/bash.yaml
+codebase_rag/parsers/ast_grep_patterns/elixir.yaml
+codebase_rag/parsers/ast_grep_patterns/haskell.yaml
+codebase_rag/parsers/ast_grep_patterns/kotlin.yaml
+codebase_rag/parsers/ast_grep_patterns/nix.yaml
 codebase_rag/parsers/ast_grep_patterns/ruby.yaml
+codebase_rag/parsers/ast_grep_patterns/solidity.yaml
+codebase_rag/parsers/ast_grep_patterns/swift.yaml
 codebase_rag/parsers/class_ingest/__init__.py
 codebase_rag/parsers/class_ingest/cpp_modules.py
 codebase_rag/parsers/class_ingest/identity.py
@@ -181,7 +191,9 @@ codebase_rag/parsers/flow_access/processor.py
 codebase_rag/parsers/frontends/__init__.py
 codebase_rag/parsers/frontends/csharp.py
 codebase_rag/parsers/frontends/go.py
+codebase_rag/parsers/frontends/java.py
 codebase_rag/parsers/frontends/protocol.py
+codebase_rag/parsers/frontends/python.py
 codebase_rag/parsers/frontends/registry.py
 codebase_rag/parsers/go/__init__.py
 codebase_rag/parsers/go/module_paths.py
@@ -216,6 +228,9 @@ codebase_rag/parsers/java/type_inference.py
 codebase_rag/parsers/java/type_resolver.py
 codebase_rag/parsers/java/utils.py
 codebase_rag/parsers/java/variable_analyzer.py
+codebase_rag/parsers/java_frontend/__init__.py
+codebase_rag/parsers/java_frontend/frontend.py
+codebase_rag/parsers/java_frontend/javac/cgr/Frontend.java
 codebase_rag/parsers/js_ts/__init__.py
 codebase_rag/parsers/js_ts/ingest.py
 codebase_rag/parsers/js_ts/module_paths.py
@@ -231,6 +246,8 @@ codebase_rag/parsers/py/expression_analyzer.py
 codebase_rag/parsers/py/type_inference.py
 codebase_rag/parsers/py/utils.py
 codebase_rag/parsers/py/variable_analyzer.py
+codebase_rag/parsers/py_frontend/__init__.py
+codebase_rag/parsers/py_frontend/frontend.py
 codebase_rag/parsers/rs/__init__.py
 codebase_rag/parsers/rs/type_inference.py
 codebase_rag/parsers/rs/utils.py
@@ -240,9 +257,11 @@ codebase_rag/providers/litellm.py
 codebase_rag/services/__init__.py
 codebase_rag/services/anthropic_token_counter.py
 codebase_rag/services/filtering.py
+codebase_rag/services/graph_diff.py
 codebase_rag/services/graph_service.py
 codebase_rag/services/llm.py
 codebase_rag/services/protobuf_service.py
+codebase_rag/services/provenance.py
 codebase_rag/services/resource_cleanup.py
 codebase_rag/services/usage_cost.py
 codebase_rag/stack/__init__.py

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/code_graph_rag.egg-info/requires.txt

@@ -24,15 +24,22 @@ pygments>=2.20.0
 ast-grep-py>=0.44.0
 pyyaml>=6.0
 
+[cpp]
+libclang>=18.1.1
+
 [milvus]
 pymilvus[milvus-lite]>=3.0.0
 
+[python-semantics]
+jedi>=0.19
+
 [semantic]
 qdrant-client>=1.9.0
 torch>=2.6.0
 transformers>=4.0.0
 
 [test]
+jedi>=0.19
 pytest>=8.4.1
 pytest-asyncio>=1.0.0
 pytest-cov>=4.0.0

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/codebase_rag/cli.py

@@ -37,8 +37,15 @@ from .main import (
     update_model_settings,
 )
 from .parser_loader import load_parsers
+from .services.graph_diff import DiffError, diff_indexes, diff_is_empty
 from .services.graph_service import MemgraphIngestor
 from .services.protobuf_service import ProtobufFileIngestor
+from .services.provenance import (
+    capture_description,
+    source_state,
+    verify_index,
+    write_manifest,
+)
 from .stack import StackManager
 from .stack.cli import cli as daemon_cli
 from .stack.constants import StackState
@@ -688,8 +695,12 @@ def index(
         unignore_paths = cgrignore.unignore or None
 
     try:
+        indexed_source = source_state(Path(repo_to_index))
+        capture_config = _capture_selection(capture)
         ingestor = ProtobufFileIngestor(
-            output_path=output_proto_dir, split_index=split_index
+            output_path=output_proto_dir,
+            split_index=split_index,
+            repo_path=str(repo_to_index),
         )
         parsers, queries = load_parsers()
         updater = GraphUpdater(
@@ -699,10 +710,18 @@ def index(
             queries=queries,
             unignore_paths=unignore_paths,
             exclude_paths=exclude_paths,
-            capture=_capture_selection(capture),
+            capture=capture_config,
         )
 
         updater.run()
+        manifest_path = write_manifest(
+            Path(output_proto_dir),
+            indexed_source,
+            capture_description(capture_config),
+        )
+        _info(
+            style(cs.CLI_MSG_MANIFEST_WRITTEN.format(path=manifest_path), cs.Color.CYAN)
+        )
         _info(style(cs.CLI_MSG_INDEXING_DONE, cs.Color.GREEN))
 
     except Exception as e:
@@ -713,6 +732,58 @@ def index(
         raise typer.Exit(1) from e
 
 
+@app.command(
+    name="verify-index",
+    help=ch.CMD_VERIFY_INDEX,
+    short_help=ch.CMD_VERIFY_INDEX,
+    rich_help_panel=ch.PANEL_GRAPH,
+)
+def verify_index_command(
+    index_dir: str = typer.Option(
+        ..., "-i", "--index-dir", help=ch.HELP_VERIFY_INDEX_DIR
+    ),
+    trusted_manifest_sha256: str | None = typer.Option(
+        None,
+        "--trusted-manifest-sha256",
+        help=ch.HELP_TRUSTED_MANIFEST_SHA,
+    ),
+) -> None:
+    problems = verify_index(Path(index_dir), trusted_manifest_sha256)
+    if problems:
+        for problem in problems:
+            app_context.console.print(
+                style(cs.CLI_MSG_VERIFY_PROBLEM.format(problem=problem), cs.Color.RED)
+            )
+        raise typer.Exit(1)
+    _info(style(cs.CLI_MSG_VERIFY_OK.format(path=index_dir), cs.Color.GREEN))
+
+
+@app.command(
+    name="diff-index",
+    help=ch.CMD_DIFF_INDEX,
+    short_help=ch.CMD_DIFF_INDEX,
+    rich_help_panel=ch.PANEL_GRAPH,
+)
+def diff_index_command(
+    old_dir: str = typer.Option(..., "--old", help=ch.HELP_DIFF_OLD),
+    new_dir: str = typer.Option(..., "--new", help=ch.HELP_DIFF_NEW),
+    json_out: str | None = typer.Option(None, "--json-out", help=ch.HELP_DIFF_JSON_OUT),
+) -> None:
+    try:
+        diff = diff_indexes(Path(old_dir), Path(new_dir))
+    except DiffError as error:
+        app_context.console.print(style(str(error), cs.Color.RED))
+        raise typer.Exit(2) from error
+    rendered = json.dumps(diff, indent=2, sort_keys=True)
+    if json_out is not None:
+        Path(json_out).write_text(rendered + "\n", encoding="utf-8")
+        _info(style(cs.CLI_MSG_DIFF_WRITTEN.format(path=json_out), cs.Color.CYAN))
+    else:
+        app_context.console.print(rendered)
+    if diff_is_empty(diff):
+        _info(style(cs.CLI_MSG_DIFF_EMPTY, cs.Color.GREEN))
+
+
 @app.command(
     help=ch.CMD_EXPORT,
     short_help=ch.CMD_EXPORT,
@@ -1256,6 +1327,7 @@ def _emit_dead_code(
     output_format: cs.DeadCodeFormat,
     output: Path | None,
     project_name: str,
+    structural_tier_symbols: int = 0,
 ) -> None:
     if output_format == cs.DeadCodeFormat.JSON:
         payload = json.dumps(candidates, indent=2)
@@ -1271,25 +1343,40 @@ def _emit_dead_code(
         typer.echo(payload)
         return
 
+    # The coverage notice follows the table into whichever sink it goes, so a
+    # saved report (CI artifact, shared review) never reads as "all clean"
+    # when whole languages went unanalyzed.
+    notice = (
+        cs.CLI_DEADCODE_STRUCTURAL_TIER_SKIPPED.format(count=structural_tier_symbols)
+        if structural_tier_symbols
+        else ""
+    )
     table = _build_dead_code_table(candidates, project_name)
     if output is not None:
         with output.open("w", encoding=cs.ENCODING_UTF8) as fh:
-            Console(file=fh).print(table)
+            file_console = Console(file=fh)
+            file_console.print(table)
+            if notice:
+                file_console.print(notice)
         app_context.console.print(
             style(
                 cs.CLI_DEADCODE_WRITTEN.format(count=len(candidates), path=output),
                 cs.Color.GREEN,
             )
         )
+        if notice:
+            app_context.console.print(style(notice, cs.Color.YELLOW))
         return
 
     if not candidates:
         app_context.console.print(style(cs.CLI_DEADCODE_NONE, cs.Color.GREEN))
-        return
-    app_context.console.print(table)
-    app_context.console.print(
-        style(cs.CLI_DEADCODE_SUMMARY.format(count=len(candidates)), cs.Color.GREEN)
-    )
+    else:
+        app_context.console.print(table)
+        app_context.console.print(
+            style(cs.CLI_DEADCODE_SUMMARY.format(count=len(candidates)), cs.Color.GREEN)
+        )
+    if notice:
+        app_context.console.print(style(notice, cs.Color.YELLOW))
 
 
 @app.command(
@@ -1330,7 +1417,7 @@ def dead_code(
         False, "--fail-on-found", help=ch.HELP_DEADCODE_FAIL_ON_FOUND
     ),
 ) -> None:
-    from .dead_code import collect_dead_code
+    from .dead_code import collect_dead_code_with_coverage
 
     show_progress = output_format == cs.DeadCodeFormat.TABLE and output is None
     if show_progress:
@@ -1339,13 +1426,14 @@ def dead_code(
     projects: list[str] = []
     resolved: str | None = None
     rows: list[ResultRow] = []
+    structural_tier_symbols = 0
     try:
         with connect_memgraph(batch_size=1) as ingestor:
             projects = ingestor.list_projects()
             resolved = _resolve_dead_code_project(project_name, projects)
             if resolved is not None:
                 logger.info(ls.DEADCODE_SCANNING.format(project_name=resolved))
-                rows = collect_dead_code(
+                rows, structural_tier_symbols = collect_dead_code_with_coverage(
                     ingestor,
                     resolved,
                     _dead_code_config(
@@ -1371,7 +1459,9 @@ def dead_code(
     candidates = [
         _to_dead_code_row(row) for row in _filter_excluded_rows(rows, exclude)
     ]
-    _emit_dead_code(candidates, output_format, output, resolved)
+    _emit_dead_code(
+        candidates, output_format, output, resolved, structural_tier_symbols
+    )
 
     if fail_on_found and candidates:
         raise typer.Exit(1)

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/codebase_rag/cli_help.py

@@ -351,3 +351,13 @@ CLI_COMMANDS: dict[CLICommandName, str] = {
     CLICommandName.DOCTOR: CMD_DOCTOR,
     CLICommandName.HELP: CMD_HELP,
 }
+CMD_VERIFY_INDEX = "Verify a protobuf index against its provenance manifest"
+HELP_VERIFY_INDEX_DIR = "Directory holding the index artifacts and manifest.json."
+HELP_TRUSTED_MANIFEST_SHA = (
+    "Externally trusted sha256 of manifest.json (e.g. from an attestation); "
+    "anchors verification beyond local self-consistency."
+)
+CMD_DIFF_INDEX = "Structural diff between two protobuf index snapshots"
+HELP_DIFF_OLD = "Directory holding the OLD snapshot artifacts."
+HELP_DIFF_NEW = "Directory holding the NEW snapshot artifacts."
+HELP_DIFF_JSON_OUT = "Write the JSON delta to FILE instead of stdout."

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/codebase_rag/config.py

@@ -212,6 +212,9 @@ class AppConfig(BaseSettings):
     # augments exact first-party call binding and external-site suppression;
     # tree-sitter stays the standalone-correct backbone.
     GO_FRONTEND: cs.GoFrontend = cs.GoFrontend.AUTO
+    PYTHON_FRONTEND: cs.PythonFrontend = cs.PythonFrontend.HEURISTIC
+    JAVA_FRONTEND: cs.JavaFrontend = cs.JavaFrontend.HEURISTIC
+    LOMBOK_JAR: str | None = None
     CAPTURE_FUNCTION_LOCAL_DEFINITIONS: bool = Field(
         True, validation_alias="CGR_CAPTURE_LOCAL_DEFINITIONS"
     )

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/codebase_rag/constants/ast_csharp.py

@@ -312,3 +312,29 @@ CSHARP_RESERVED_KEYWORDS = frozenset(
         "while",
     }
 )
+
+
+# Await plumbing that returns the SAME value in a different wrapper: the flow
+# walk recurses a method-call receiver only through these, so without them
+# `await FetchAsync().ConfigureAwait(false)` loses the receiver's taint and a
+# sink fed from it has no edge. `ConfigureAwait` is near-universal in library
+# code, so this shape is common rather than exotic (issue #1187).
+CSHARP_TAINT_TRANSPARENT_METHODS = frozenset(
+    {
+        "ConfigureAwait",
+        "GetAwaiter",
+        "GetResult",
+        "AsTask",
+    }
+)
+
+
+# Deconstructing declaration: `var (a, b) = (x, y)` binds through a pattern
+# child and a tuple child rather than the usual name/value fields.
+TS_CSHARP_TUPLE_PATTERN = "tuple_pattern"
+TS_CSHARP_TUPLE_EXPRESSION = "tuple_expression"
+TS_CSHARP_DECLARATION_EXPRESSION = "declaration_expression"
+# `if (o is string s)` binds `s` to the SUBJECT's value, so taint has to cross
+# the pattern or the bound name looks clean inside the branch.
+TS_CSHARP_IS_PATTERN = "is_pattern_expression"
+TS_CSHARP_DECLARATION_PATTERN = "declaration_pattern"

{code_graph_rag-0.0.670 → code_graph_rag-0.0.720}/codebase_rag/constants/ast_dart.py

@@ -23,6 +23,10 @@ TS_DART_LABEL = "label"
 # Python's `conditional_expression` node TYPE but orders operands
 # [condition, consequence, alternative], not [body, condition, alternative].
 TS_DART_LIST_LITERAL = "list_literal"
+# `await expr` parses as unary_expression > await_expression > chain; the
+# awaited value carries the chain's taint and handle (issue #1224).
+TS_DART_UNARY_EXPRESSION = "unary_expression"
+TS_DART_AWAIT_EXPRESSION = "await_expression"
 TS_DART_SET_OR_MAP_LITERAL = "set_or_map_literal"
 # Inside a set_or_map_literal: a MAP entry is a `pair` whose `value` field
 # holds the stored expression; `type_arguments` (`<String, T>{...}`) carry
@@ -65,6 +69,7 @@ DART_PATTERN_NODE_SUFFIX = "_pattern"
 # swallows a trailing ternary as its LAST named child.
 DART_EXPRESSION_NODE_SUFFIX = "_expression"
 TS_DART_FUNCTION_EXPRESSION = "function_expression"
+TS_DART_FUNCTION_EXPRESSION_BODY = "function_expression_body"
 TS_DART_LOCAL_FUNCTION_DECLARATION = "local_function_declaration"
 
 # Nodes opening their OWN variable scope: the local-type walk must not descend,
@@ -93,6 +98,8 @@ TS_DART_FORMAL_PARAMETER_LIST = "formal_parameter_list"
 TS_DART_SWITCH_STATEMENT_CASE = "switch_statement_case"
 TS_DART_SWITCH_STATEMENT_DEFAULT = "switch_statement_default"
 TS_DART_TEMPLATE_SUBSTITUTION = "template_substitution"
+# The bare `$name` interpolation form wraps its name in this node type.
+TS_DART_IDENTIFIER_DOLLAR_ESCAPED = "identifier_dollar_escaped"
 # `[String m]` (optional positional) and `{String? m}` (named) both wrap their
 # `formal_parameter`s in an `optional_formal_parameters` node (issue #1173).
 TS_DART_OPTIONAL_FORMAL_PARAMETERS = "optional_formal_parameters"