code-graph-rag 0.2.10__tar.gz → 0.2.19__tar.gz

{code_graph_rag-0.2.10/code_graph_rag.egg-info → code_graph_rag-0.2.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-graph-rag
-Version: 0.2.10
+Version: 0.2.19
 Summary: The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
 License-Expression: MIT
 Keywords: rag,retrieval-augmented-generation,knowledge-graph,code-analysis,tree-sitter,mcp,mcp-server,llm,graph-database,semantic-search,codebase,memgraph,developer-tools,monorepo
@@ -49,7 +49,7 @@ Requires-Dist: pytest-xdist>=3.8.0; extra == "test"
 Requires-Dist: testcontainers>=4.9.0; extra == "test"
 Requires-Dist: libclang>=18.1.1; extra == "test"
 Requires-Dist: filelock>=3.12; extra == "test"
-Requires-Dist: ast-grep-py>=0.44.0; extra == "test"
+Requires-Dist: ast-grep-py>=0.51.0; extra == "test"
 Requires-Dist: pyyaml>=6.0; extra == "test"
 Requires-Dist: pymgclient>=1.6.0; extra == "test"
 Requires-Dist: sqlite-vec>=0.1.9; extra == "test"
@@ -85,7 +85,7 @@ Requires-Dist: pymilvus[milvus-lite]>=3.0.0; extra == "milvus"
 Provides-Extra: sqlite-vec
 Requires-Dist: sqlite-vec>=0.1.9; extra == "sqlite-vec"
 Provides-Extra: ast-grep
-Requires-Dist: ast-grep-py>=0.44.0; extra == "ast-grep"
+Requires-Dist: ast-grep-py>=0.51.0; extra == "ast-grep"
 Requires-Dist: pyyaml>=6.0; extra == "ast-grep"
 Provides-Extra: python-semantics
 Requires-Dist: jedi>=0.19; extra == "python-semantics"
@@ -152,8 +152,9 @@ transformers are then not required locally.
 `pip install code-graph-rag` gives you the newest PyPI release, which is deliberately
 not the newest commit. Git tags exist for every version (one per merge), while PyPI
 uploads and GitHub Release binaries land on an every-50 cadence, so the tag on `main`
-usually runs ahead of the published version. A security fix is the exception: it
-ships immediately rather than waiting for the cadence.
+usually runs ahead of the published version. A security fix, a breaking change or a
+merge a maintainer labels `release now` is the exception: each ships immediately
+rather than waiting for the cadence.
 
 To run code newer than the latest release, install from git with uv:
 

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/PYPI_README.md

@@ -59,8 +59,9 @@ transformers are then not required locally.
 `pip install code-graph-rag` gives you the newest PyPI release, which is deliberately
 not the newest commit. Git tags exist for every version (one per merge), while PyPI
 uploads and GitHub Release binaries land on an every-50 cadence, so the tag on `main`
-usually runs ahead of the published version. A security fix is the exception: it
-ships immediately rather than waiting for the cadence.
+usually runs ahead of the published version. A security fix, a breaking change or a
+merge a maintainer labels `release now` is the exception: each ships immediately
+rather than waiting for the cadence.
 
 To run code newer than the latest release, install from git with uv:
 

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/README.md

@@ -61,7 +61,8 @@ Code-Graph-RAG parses a multi-language codebase with Tree-sitter, sharpened by c
 ## Latest News 🔥
 
 <!-- SECTION:latest_news -->
-- **GitHub Sponsors**: Added support for GitHub Sponsors via the command line.
+- **Dependency Locking**: Locked `opentelemetry-api` to version 1.45.1 for stability.
+- **GHSA Security Fix**: Addressed GHSA-xcq7-p3pf-p88h vulnerability.
 <!-- /SECTION:latest_news -->
 
 See [NEWS.md](NEWS.md) for the full history.
@@ -118,13 +119,14 @@ Three version lines exist and they intentionally differ:
 | where | what it tracks |
 |---|---|
 | git tags | every version, one per merge |
-| GitHub Releases (binaries, signatures) | every 50th version, plus any security fix |
-| PyPI | every 50th version, plus any security fix |
+| GitHub Releases (binaries, signatures) | every 50th version, plus any security fix, breaking change or merge labelled `release now` |
+| PyPI | every 50th version, plus any security fix, breaking change or merge labelled `release now` |
 
 So the newest tag on `main` usually runs ahead of the newest release, often by
 tens of patch versions; they coincide only just after a release. Nothing is
-stuck, the cadences differ by design. A security fix does NOT wait for the
-cadence: it ships a release and a PyPI upload immediately.
+stuck, the cadences differ by design. A security fix, a breaking change or a
+merge a maintainer labels `release now` does NOT wait for the cadence: each ships
+a release and a PyPI upload immediately.
 
 `uv tool install` and `pipx install` give you the newest PyPI version, which is the
 newest RELEASE, not the newest tag. Interim tags exist so every merge is

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19/code_graph_rag.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-graph-rag
-Version: 0.2.10
+Version: 0.2.19
 Summary: The ultimate RAG for your monorepo. Query, understand, and edit multi-language codebases with the power of AI and knowledge graphs
 License-Expression: MIT
 Keywords: rag,retrieval-augmented-generation,knowledge-graph,code-analysis,tree-sitter,mcp,mcp-server,llm,graph-database,semantic-search,codebase,memgraph,developer-tools,monorepo
@@ -49,7 +49,7 @@ Requires-Dist: pytest-xdist>=3.8.0; extra == "test"
 Requires-Dist: testcontainers>=4.9.0; extra == "test"
 Requires-Dist: libclang>=18.1.1; extra == "test"
 Requires-Dist: filelock>=3.12; extra == "test"
-Requires-Dist: ast-grep-py>=0.44.0; extra == "test"
+Requires-Dist: ast-grep-py>=0.51.0; extra == "test"
 Requires-Dist: pyyaml>=6.0; extra == "test"
 Requires-Dist: pymgclient>=1.6.0; extra == "test"
 Requires-Dist: sqlite-vec>=0.1.9; extra == "test"
@@ -85,7 +85,7 @@ Requires-Dist: pymilvus[milvus-lite]>=3.0.0; extra == "milvus"
 Provides-Extra: sqlite-vec
 Requires-Dist: sqlite-vec>=0.1.9; extra == "sqlite-vec"
 Provides-Extra: ast-grep
-Requires-Dist: ast-grep-py>=0.44.0; extra == "ast-grep"
+Requires-Dist: ast-grep-py>=0.51.0; extra == "ast-grep"
 Requires-Dist: pyyaml>=6.0; extra == "ast-grep"
 Provides-Extra: python-semantics
 Requires-Dist: jedi>=0.19; extra == "python-semantics"
@@ -152,8 +152,9 @@ transformers are then not required locally.
 `pip install code-graph-rag` gives you the newest PyPI release, which is deliberately
 not the newest commit. Git tags exist for every version (one per merge), while PyPI
 uploads and GitHub Release binaries land on an every-50 cadence, so the tag on `main`
-usually runs ahead of the published version. A security fix is the exception: it
-ships immediately rather than waiting for the cadence.
+usually runs ahead of the published version. A security fix, a breaking change or a
+merge a maintainer labels `release now` is the exception: each ships immediately
+rather than waiting for the cadence.
 
 To run code newer than the latest release, install from git with uv:
 

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/code_graph_rag.egg-info/SOURCES.txt

@@ -270,6 +270,7 @@ codebase_rag/parsers/csharp_frontend/roslyn/Frontend.cs
 codebase_rag/parsers/csharp_frontend/roslyn/Frontend.csproj
 codebase_rag/parsers/csharp_frontend/roslyn/Program.cs
 codebase_rag/parsers/dart/__init__.py
+codebase_rag/parsers/dart/package_paths.py
 codebase_rag/parsers/dart/type_inference.py
 codebase_rag/parsers/dart/utils.py
 codebase_rag/parsers/flow_access/__init__.py
@@ -315,6 +316,7 @@ codebase_rag/parsers/io_access/extract.py
 codebase_rag/parsers/io_access/models.py
 codebase_rag/parsers/io_access/processor.py
 codebase_rag/parsers/io_access/registry.py
+codebase_rag/parsers/io_access/resource_names.py
 codebase_rag/parsers/io_access/url_folding.py
 codebase_rag/parsers/java/__init__.py
 codebase_rag/parsers/java/method_resolver.py

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/code_graph_rag.egg-info/requires.txt

@@ -24,7 +24,7 @@ regex>=2024.11.6
 cgr-graph-rs<0.2,>=0.1.0
 
 [ast-grep]
-ast-grep-py>=0.44.0
+ast-grep-py>=0.51.0
 pyyaml>=6.0
 
 [cpp]
@@ -59,7 +59,7 @@ pytest-xdist>=3.8.0
 testcontainers>=4.9.0
 libclang>=18.1.1
 filelock>=3.12
-ast-grep-py>=0.44.0
+ast-grep-py>=0.51.0
 pyyaml>=6.0
 pymgclient>=1.6.0
 sqlite-vec>=0.1.9

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/cli.py

@@ -60,6 +60,7 @@ from .graph_cli import cli as graph_cli
 from .graph_dialects import DIALECT_MEMGRAPH
 from .parser_loader import load_parsers
 from .project_selection import ProjectChoice, choose_project, scope_refusal
+from .services.gloss_cleanup import prune_orphaned_glosses
 from .services.graph_diff import DiffError, diff_indexes, diff_is_empty
 from .services.graph_service import GraphUnavailableError, MemgraphIngestor
 from .services.protobuf_service import ProtobufFileIngestor
@@ -1069,6 +1070,28 @@ def _clear_deleted_project_markers(
         logger.warning(ls.CLI_DELETE_SYNC_MARKER_KEPT.format(project=project_name))
 
 
+def _sweep_glosses_after_failed_delete(
+    ingestor: MemgraphIngestor, project_name: str
+) -> None:
+    """Sweep the notes of a delete that raised after the project was removed.
+
+    The delete commits statement by statement, so a later cleanup can raise
+    once the project is already gone, and a retry then stops at "project not
+    found" before any sweep. A project still listed keeps its unattached
+    notes: they are LOST or AMBIGUOUS by design and readable on their old
+    names. Never raises, so the delete's own error is what is reported.
+    """
+    try:
+        still_listed = project_name in ingestor.list_projects()
+    except Exception as exc:
+        logger.warning(
+            ls.CLI_DELETE_GLOSS_SWEEP_SKIPPED.format(project=project_name, error=exc)
+        )
+        return
+    if not still_listed:
+        prune_orphaned_glosses(ingestor, project_name)
+
+
 def _run_updater_deferring_interrupt(
     updater: "GraphUpdater",
 ) -> KeyboardInterrupt | None:
@@ -1207,10 +1230,33 @@ def _run_graph_sync(
                 cs.StyleModifier.NONE,
             )
         )
+        _report_call_pass_failures(repo, list(updater.call_pass_failures))
     if interrupted is not None:
         raise interrupted
 
 
+def _report_call_pass_failures(repo: Path, failed: list[Path]) -> None:
+    # A file whose call pass failed lost edges while the sync still reads
+    # "done": the error lines scroll away, so the summary counts them (#3173).
+    if not failed:
+        return
+    names = sorted(
+        path.relative_to(repo).as_posix() if path.is_relative_to(repo) else str(path)
+        for path in failed
+    )
+    shown = names[: cs.CLI_CALL_PASS_FAILURES_SHOWN]
+    if len(names) > len(shown):
+        shown.append(cs.CLI_MSG_AND_MORE.format(count=len(names) - len(shown)))
+    app_context.console.print(
+        style(
+            cs.CLI_MSG_CALL_PASS_FAILURES.format(
+                count=len(names), files=", ".join(shown)
+            ),
+            cs.Color.YELLOW,
+        )
+    )
+
+
 def _delete_hash_cache(repo_path: Path) -> None:
     # Resolving the state directory also moves in what an older cgr left in
     # the tree, so a clean right after upgrading clears that copy too.
@@ -3519,7 +3565,26 @@ def delete_project(
                 )
             )
             _cleanup_project_embeddings(ingestor, project_name, projects)
-            ingestor.delete_project(project_name)
+            try:
+                ingestor.delete_project(project_name)
+            except Exception:
+                _sweep_glosses_after_failed_delete(ingestor, project_name)
+                raise
+            # A Gloss is out of the delete's reach by design, which is what
+            # lets it survive an index's delete-then-rebuild, so the
+            # deliberate delete sweeps the project's notes, as MCP
+            # `delete_project` does. Without it the next index re-attached
+            # them by name (issue #3231). The sweep never raises: the delete
+            # is done, and a retry would stop at "project not found".
+            if not prune_orphaned_glosses(ingestor, project_name):
+                app_context.console.print(
+                    style(
+                        cs.CLI_WARN_GLOSSES_NOT_PRUNED.format(
+                            project_name=project_name
+                        ),
+                        cs.Color.YELLOW,
+                    )
+                )
             _clear_deleted_project_markers(ingestor, project_name)
     except typer.Exit:
         raise

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/cli_help.py

@@ -169,8 +169,10 @@ HELP_CHECK_BASE = (
 )
 HELP_CHECK_FAIL_ON_FOUND = (
     "Exit with status 1 when the delta reports dangling callers, dangling "
-    "importers, calls with too many arguments, new duplicates or new import "
-    "cycles. A possibly_missing site is reported but does not fail the check."
+    "importers, calls with too many arguments, too few for a required "
+    "parameter or a keyword the callee does not accept, new duplicates or new "
+    "import cycles. A possibly_missing site is reported but does not fail the "
+    "check."
 )
 HELP_CHECK_ISOLATED = (
     "Measure the edit, then put the graph and the hash cache back so the "

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/ast_dart.py

@@ -216,6 +216,13 @@ DART_SCHEME_DART = "dart:"
 DART_SCHEME_PACKAGE = "package:"
 DART_QUOTE_CHARS = "'\""
 DART_EXT = ".dart"
+# A `package:<name>/<path>` import names `<path>` under the `lib/` beside the
+# pubspec whose top-level `name:` is `<name>` (issue #3278). The name is a
+# Dart identifier, optionally quoted, optionally followed by a comment.
+DART_PACKAGE_LIB_DIR = "lib"
+DART_PUBSPEC_NAME_PATTERN = (
+    r"^name:[ \t]*['\"]?([A-Za-z_][A-Za-z0-9_]*)['\"]?[ \t]*(?:#.*)?$"
+)
 
 # Node types whose captured signature needs the sibling-body span fix.
 DART_SIGNATURE_TYPES = frozenset(

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/ast_python.py

@@ -409,6 +409,8 @@ PROPERTY_DECORATORS: frozenset[str] = frozenset({"property", "cached_property"})
 ABSTRACT_DECORATORS: frozenset[str] = frozenset({"abstractmethod", "abstractproperty"})
 # A static method takes no receiver: a first parameter named `self` is explicit.
 STATIC_DECORATORS: frozenset[str] = frozenset({"staticmethod"})
+# A class method binds `cls` even when called through its class.
+CLASSMETHOD_DECORATORS: frozenset[str] = frozenset({"classmethod"})
 
 # Eager builtins that invoke a callable argument synchronously in the caller's
 # stack frame, so the trace attributes the call to the enclosing function (no

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/ast_rust.py

@@ -156,6 +156,9 @@ RS_MACRO_RECEIVER_TYPES = RS_IDENT_OR_SELF
 # (`server . run`, `Config :: load`), and the segments a `::` path takes
 # (`Self` is an identifier token; `crate`, `super`, `self` are keywords).
 RS_MACRO_CHAIN_SEPARATORS = (TS_RS_TOKEN_DOT, TS_RS_TOKEN_SCOPE)
+# How far each token moves the nesting of a turbofish's generic arguments in a
+# macro token stream, where `Vec<Vec<u8>>` closes with one `>>` token.
+RS_MACRO_ANGLE_DEPTH = {"<": 1, ">": -1, ">>": -2}
 RS_MACRO_PATH_SEGMENT_TYPES = (TS_IDENTIFIER, KEYWORD_SELF, TS_RS_CRATE, KEYWORD_SUPER)
 # Rust `Self` return type resolves to the enclosing impl target.
 RS_SELF_TYPE = "Self"
@@ -294,6 +297,9 @@ RS_MANIFEST_KIND_DIRS = {
 }
 RS_MANIFEST_WORKSPACE_KEY = "workspace"
 RS_MANIFEST_MEMBERS_KEY = "members"
+# A workspace member that is the root package itself, and its `./` prefix.
+RS_CURRENT_DIR = "."
+RS_CURRENT_DIR_PREFIX = "./"
 RS_MANIFEST_NAME_KEY = "name"
 RS_MANIFEST_LIB_SECTION = "lib"
 RS_MANIFEST_DEP_SECTIONS = ("dependencies", "dev-dependencies", "build-dependencies")

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/cli.py

@@ -170,6 +170,12 @@ MSG_SYNCING_WORKSPACE = (
 )
 CLI_MSG_SYNC_SKIPPED = "Knowledge graph already in sync for '{project}' ({elapsed:.2f}s, no changes detected)."
 CLI_MSG_SYNC_DONE = "Knowledge graph sync done for '{project}' in {elapsed:.2f}s."
+CLI_MSG_CALL_PASS_FAILURES = (
+    "Call analysis failed in {count} file(s); their CALLS edges may be "
+    "incomplete (see the errors above): {files}"
+)
+CLI_CALL_PASS_FAILURES_SHOWN = 10
+CLI_MSG_AND_MORE = "... {count} more"
 CLI_MSG_SYNC_INTERRUPTED = (
     "Interrupted: the graph for '{project}' is incomplete; re-run "
     "'cgr start --update-graph' with the same options to finish it."
@@ -249,6 +255,10 @@ CLI_ERR_CLEAN_UNKNOWN_PROJECTS = (
 CLI_MSG_CLEAN_ABORTED = "Aborted: the graph was left untouched."
 CLI_MSG_DELETING_PROJECT = "Deleting project '{project_name}' from the graph..."
 CLI_MSG_PROJECT_DELETED = "Project '{project_name}' deleted successfully."
+CLI_WARN_GLOSSES_NOT_PRUNED = (
+    "Warning: the notes (glosses) of project '{project_name}' could not be "
+    "removed and remain in the graph unattached; the log has the error."
+)
 CLI_WARN_DELETE_PROJECT_SHARED_ROOT = (
     "Warning: project(s) {projects} were indexed from the same directory as "
     "'{project_name}' ({root_path}). Only what '{project_name}' owns is "
@@ -355,8 +365,8 @@ CHECK_NOT_INDEXED = (
 # before rebuilding them from the edited tree, so those edges cannot be put
 # back. Refused rather than silently lost (greptile-local, #1718).
 CHECK_ISOLATED_GRAPH_HAS_IO = (
-    "--isolated cannot restore the IO resource links this graph already "
-    "holds ({groups}): cutting a changed file's subtree can leave a resource "
+    "--isolated cannot restore the IO resource links project {project}'s code "
+    "anchors ({groups}): cutting a changed file's subtree can leave a resource "
     "chain unanchored, and the re-ingest's repo-wide resource prune would "
     "delete it. Re-run without --isolated on a graph you can rebuild."
 )
@@ -535,6 +545,12 @@ UI_NEW_FILE_HEADER = "[bold cyan]New file: {path}[/bold cyan]"
 UI_SHELL_COMMAND_HEADER = "[bold cyan]Shell command:[/bold cyan]"
 UI_TOOL_APPROVAL = "[bold yellow]⚠️  Tool '{tool_name}' requires approval:[/bold yellow]"
 UI_FEEDBACK_PROMPT = "Feedback (why rejected, or press Enter to skip)"
+# `cgr start -a` has no operator to ask: what the model is told when it asks
+# for an edit or a non-read-only command without --no-confirm (issue #2657).
+ASK_AGENT_APPROVAL_DENIED = (
+    "Edits and non-read-only commands are disabled in --ask-agent mode; "
+    "answer without them. The user can re-run with --no-confirm to allow them."
+)
 UI_OPTIMIZATION_START = (
     "[bold green]Starting {language} optimization session...[/bold green]"
 )

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/core.py

@@ -10,6 +10,15 @@ PY_PACKAGE_INIT_FILES: tuple[str, ...] = (INIT_PY, INIT_PYI)
 
 ENCODING_UTF8 = "utf-8"
 ENCODING_UTF8_SIG = "utf-8-sig"
+# BOM-aware: decoding picks the byte order from the mark and drops it.
+ENCODING_UTF16 = "utf-16"
+ENCODING_UTF32 = "utf-32"
+# One byte order each, for the text after a BOM: writing that text back in
+# one of these, behind the same mark, gives the file's own bytes.
+ENCODING_UTF16_LE = "utf-16-le"
+ENCODING_UTF16_BE = "utf-16-be"
+ENCODING_UTF32_LE = "utf-32-le"
+ENCODING_UTF32_BE = "utf-32-be"
 ENCODING_ASCII = "ascii"
 # Codec names (as `codecs.lookup` normalises them) whose bytes the grammar
 # already reads as they are, so a source declaring one needs no transcoding.

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/duplicates.py

@@ -127,18 +127,46 @@ DELTA_ARITY_TOO_MANY = "too_many"
 DELTA_ARITY_TOO_FEW = "too_few"
 DELTA_ARITY_POSSIBLY_MISSING = "possibly_missing"
 DELTA_ARITY_UNKNOWN = "unknown"
+# Definite only where the callee's header was read back (issues #2853,
+# #2845): a keyword the new signature does not accept, with no `**kwargs`,
+# and a required parameter no argument fills, with no splat to supply it.
+DELTA_ARITY_UNEXPECTED_KEYWORD = "unexpected_keyword"
+# The verdicts that fail `--fail-on-found`: each is a certain `TypeError`.
+DELTA_ARITY_DEFINITE = frozenset(
+    {DELTA_ARITY_TOO_MANY, DELTA_ARITY_UNEXPECTED_KEYWORD, DELTA_ARITY_TOO_FEW}
+)
+# Decorators that hand the call to the def as written; any other may change
+# what a caller must pass, so the header alone settles nothing.
+PY_STATICMETHOD = "staticmethod"
+PY_SIGNATURE_PRESERVING_DECORATORS = frozenset(
+    {
+        PY_STATICMETHOD,
+        "classmethod",
+        "abstractmethod",
+        "abc.abstractmethod",
+        "override",
+        "typing.override",
+        "typing_extensions.override",
+    }
+)
 
 
 # What still names a removed or renamed symbol in a structural delta's
 # `dangling_importers` (issue #2516): an import statement binding it, or a
-# Python `__all__` string entry exporting it.
+# Python `__all__` string entry exporting it. `module` is an import of a
+# module the edit deleted or moved (issue #3266): `import pkg.signals`,
+# `from pkg import util`, `export * from "./util"`.
 class DanglingImportKind(StrEnum):
     IMPORT = "import"
     ALL = "__all__"
+    MODULE = "module"
 
 
 # Hops the backward test-reach walk follows before giving up.
 DELTA_REACH_MAX_DEPTH = 12
+# Source files whose syntax tree the arity verdicts keep while judging one
+# delta's sites (issue #2899): one parse per file version, however many sites.
+DELTA_PARSED_SOURCES_KEPT = 64
 
 # Cypher return alias for the not-analyzed symbol count.
 KEY_SKIPPED = "skipped"

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/graph.py

@@ -209,6 +209,10 @@ KEY_UNRESOLVED_SPECIFIERS = "unresolved_specifiers"
 # so the modules that waited for it are re-parsed (issue #1568). Written
 # unconditionally on every parse so a resolved name clears.
 KEY_UNRESOLVED_REFERENCES = "unresolved_references"
+# The dotted namespace a PHP file declares (`App.Util`), on its Module: a
+# `use function App\\Util\\slug` matches it, and only a parse of the file
+# gives it, so an incremental run reads it back from here (issue #3277).
+KEY_PHP_NAMESPACE = "php_namespace"
 KEY_ABSOLUTE_PATH = "absolute_path"
 # Whether flow analysis covered a Module: its language is in the source/sink
 # registry AND the FLOWS_TO capture group was enabled at indexing. Read by
@@ -837,6 +841,9 @@ KEY_ANCHOR = "anchor"
 # omitted key, so a fixed link would otherwise stay listed as broken.
 KEY_BROKEN_LINKS = "broken_links"
 KEY_DECORATORS = "decorators"
+# The largest line a `path:line` target is looked up at: past it no source
+# file has the line, and the value would overflow a Bolt integer.
+GRAPH_MAX_SOURCE_LINE = 2**31 - 1
 # Return and parameter annotations as written (issue #1527). `return_type` is
 # absent when the definition has none; `param_types` is parallel to the
 # declared parameters ("" for an unannotated one) and absent, not empty, for
@@ -991,6 +998,13 @@ MILVUS_IDS_EXPR = "{field} in {ids}"
 # Milvus answers a delete with the deleted keys or with this count.
 MILVUS_DELETE_COUNT_KEY = "delete_count"
 
+# The ownership relations a Module's subtree hangs off, walked by the
+# re-parse delete and by the lookup of files that attach members to it.
+MODULE_SUBTREE_REL_PATTERN = (
+    "DEFINES|DEFINES_METHOD|CONTAINS_SECTION|HAS_PARAMETER"
+    "|HAS_FIELD|HAS_VARIANT|DEFINES_CONSTANT"
+    "|IMPLEMENTS_PATTERN|HAS_SMELL|HAS_VULNERABILITY"
+)
 CYPHER_DELETE_MODULE = (
     # Scoped to the project: two projects in the shared graph can hold the
     # same relative path, and a path-only match would take the sibling's
@@ -1030,9 +1044,7 @@ CYPHER_DELETE_MODULE = (
     # re-parse stripped its edge and left the node: an orphan per re-parse
     # after a sync that drops the `findings` capture group, or per finding
     # the edited source no longer matches (issue #2536).
-    "OPTIONAL MATCH (m)-[:DEFINES|DEFINES_METHOD|CONTAINS_SECTION|HAS_PARAMETER"
-    "|HAS_FIELD|HAS_VARIANT|DEFINES_CONSTANT"
-    "|IMPLEMENTS_PATTERN|HAS_SMELL|HAS_VULNERABILITY*0..]->(c) "
+    f"OPTIONAL MATCH (m)-[:{MODULE_SUBTREE_REL_PATTERN}*0..]->(c) "
     "DETACH DELETE m, c"
 )
 # Keyed on absolute_path: the relative path is shared across same-layout
@@ -1240,7 +1252,8 @@ CYPHER_ALL_DEFINITION_QNS = (
 CYPHER_ALL_MODULE_QNS = (
     "MATCH (n) WHERE (n:Module OR n:ModuleInterface) "
     "AND n.qualified_name STARTS WITH $project_prefix "
-    "RETURN n.qualified_name AS qualified_name, head(labels(n)) AS label"
+    "RETURN n.qualified_name AS qualified_name, head(labels(n)) AS label, "
+    "n.php_namespace AS php_namespace"
 )
 
 # Inbound reference edges (from unchanged files) into symbols defined in one
@@ -1303,6 +1316,19 @@ CYPHER_INBOUND_EDGES = (
 # like INHERITS: an implementor in the same package holds no import edge into
 # its interface's file, and without this it was neither re-parsed nor
 # restored when that file was re-indexed (issue #1565).
+# Files that attach members to these modules' subtrees: a Go method keyed
+# under its receiver type's module whatever file declares it, a C++
+# out-of-line definition hung on its header's class. The re-parse delete
+# walks the subtree and takes them, and only their own file recreates them,
+# so they must re-parse in the same run (issue #3271).
+CYPHER_FOREIGN_MEMBER_PATHS = (
+    "MATCH (m:Module) WHERE m.path IN $paths "
+    "AND (m.qualified_name = $project_name "
+    "OR m.qualified_name STARTS WITH $project_prefix) "
+    f"MATCH (m)-[:{MODULE_SUBTREE_REL_PATTERN}*1..]->(c) "
+    "WHERE c.path IS NOT NULL AND NOT c.path IN $paths "
+    "RETURN DISTINCT c.path AS path"
+)
 CYPHER_AFFECTED_CALLER_PATHS = (
     "MATCH (caller)-[:CALLS|REFERENCES|INSTANTIATES|IMPORTS|INHERITS|IMPLEMENTS]->(target) "
     "WHERE target.path IN $paths AND caller.path IS NOT NULL "
@@ -1405,6 +1431,22 @@ CYPHER_UNRESOLVED_IMPORTER_PATHS = (
     "OR target.qualified_name STARTS WITH (name + '.')) "
     "RETURN DISTINCT importer.path AS caller_path"
 )
+# Every IMPORTS edge written for a `package:` URI, with where it went (issue
+# #3278 review). A Dart pubspec's `name:` decides whether `package:<name>/...`
+# is a module of the project or an external package, so adding, deleting or
+# renaming one moves those imports while the importers stay unchanged on
+# disk, and no edge leads from them to the pubspec for the dependents lookup
+# to follow. The caller resolves each URI again and keeps the moved ones.
+CYPHER_PACKAGE_URI_IMPORTS = (
+    "MATCH (importer)-[r:IMPORTS]->(target) "
+    "WHERE importer.path IS NOT NULL "
+    "AND importer.qualified_name STARTS WITH $project_prefix "
+    "AND r.imported_name STARTS WITH $uri_prefix "
+    "RETURN DISTINCT importer.path AS caller_path, "
+    "importer.qualified_name AS from_qn, r.imported_name AS imported_name, "
+    "target.qualified_name AS to_qn"
+)
+CYPHER_PARAM_URI_PREFIX = "uri_prefix"
 # Modules carrying at least one unresolved relative specifier, with the
 # specifiers themselves. The specifier is relative to the IMPORTING module's
 # directory, so the match against a created file is resolved in Python rather

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/mcp.py

@@ -134,6 +134,17 @@ MCP_JSON_INDENT = 2
 MCP_LOG_LEVEL_INFO = "INFO"
 MCP_LOG_FORMAT = "<green>{time:YYYY-MM-DD HH:mm:ss}</green> | <level>{level: <8}</level> | <level>{message}</level>"
 MCP_PAGINATION_HEADER = "# Lines {start}-{end} of {total}\n"
+# `read_file`'s window, refused in its own terms rather than as whatever
+# `islice()` says of a negative index, or as "Lines 1001-1000 of 7"
+# (issue #3244). The schema bounds them too; a direct call is checked here.
+MCP_READ_OFFSET_MINIMUM = 0
+MCP_READ_LIMIT_MINIMUM = 1
+MCP_READ_OFFSET_NEGATIVE = "offset {offset} is negative"
+MCP_READ_LIMIT_NOT_POSITIVE = "limit {limit} is not positive"
+MCP_READ_PAST_END = "offset {offset} is past the end of {path} ({total} lines)"
+# A `path:line` target whose line no source file can reach; sent on, it
+# overflows the 64-bit Bolt integer in the driver.
+MCP_RESOLVE_LINE_OUT_OF_RANGE = "Line {line} of {path} is out of range."
 
 # MCP response messages
 MCP_INDEX_SUCCESS = "Successfully indexed repository at {path}. Knowledge graph has been updated (previous data cleared)."
@@ -212,6 +223,10 @@ MCP_SEMANTIC_NOT_AVAILABLE_RESPONSE = (
     "Semantic search is not available. Install with: uv sync --extra semantic"
 )
 MCP_ASK_AGENT_ERROR = "Error running ask_agent: {error}"
+MCP_ASK_AGENT_APPROVAL_DENIED = (
+    "ask_agent cannot edit files or run non-read-only commands; answer "
+    "without them. The client can make the change with the MCP edit tools."
+)
 # Refused rather than answered with zero rows: an empty result for a
 # misspelled project name is indistinguishable from a genuine empty result.
 MCP_UNKNOWN_PROJECT = "Unknown project {project!r}. Indexed projects: {known}"
@@ -235,6 +250,11 @@ MCP_ROOT_NOT_INDEXED = (
 # it" / "no test reaches it" (issue #2461).
 MCP_UNKNOWN_TARGET = "{qualified_name!r} is not in the graph."
 MCP_UNKNOWN_TARGET_HINT = " `resolve` lists the qualified names a name matches."
+MCP_UNKNOWN_ENDPOINT = (
+    "{target!r} names no endpoint project {project!r} exposes: neither a "
+    "handler nor an endpoint identity."
+)
+MCP_UNKNOWN_ENDPOINT_HINT = " `endpoints` lists the project's identities and handlers."
 # `flow_verdict` with a source or sink it cannot walk from (issue #2939).
 MCP_FLOW_SOURCE = "source"
 MCP_FLOW_SINK = "sink"

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/providers.py

@@ -211,3 +211,13 @@ class UniXcoderMode(StrEnum):
 UNIXCODER_MASK_TOKEN = "<mask0>"
 UNIXCODER_BUFFER_BIAS = "bias"
 UNIXCODER_MAX_CONTEXT = 1024
+
+
+# An agent run with no operator settles every tool approval itself (the CLI's
+# `-a`, MCP's ask_agent; issue #2657). A model that asks again after every
+# answer would otherwise loop forever.
+NONINTERACTIVE_APPROVAL_ROUNDS = 10
+NONINTERACTIVE_APPROVAL_LOOP = (
+    "The agent still requested tool approval after {rounds} rounds of answers; "
+    "stopped without a text answer."
+)

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/structural.py

@@ -59,6 +59,10 @@ AST_GREP_UNKNOWN_LANGUAGE = (
     "Unknown or unsupported language '{language}'. Supported: {supported}"
 )
 AST_GREP_INVALID_PATTERN = "Invalid ast-grep pattern '{pattern}': {error}"
+# ast-grep's error carries its whole cause chain and a Rust backtrace; the
+# deepest numbered cause before the backtrace is the one that says why.
+AST_GREP_BACKTRACE_MARKER = "Stack backtrace:"
+AST_GREP_CAUSE = re.compile(r"^\s*\d+: (?P<cause>.+)$")
 AST_GREP_TRUNCATED = (
     "Result cap of {limit} reached; narrow the pattern or raise the limit for more."
 )

{code_graph_rag-0.2.10 → code_graph_rag-0.2.19}/codebase_rag/constants/trace.py

@@ -105,6 +105,17 @@ TRACE_MSG_ADDRS_UNRESOLVED = (
 TRACE_ERR_BAD_XDEBUG = (
     "{path} is not an Xdebug computerized trace (expected 'File format: 4')."
 )
+TRACE_ERR_BAD_XDEBUG_GZIP = (
+    "{path} is gzip-compressed but truncated or corrupt, so it cannot be read "
+    "as an Xdebug trace."
+)
+TRACE_ERR_XDEBUG_TOO_LARGE = (
+    "{path} decompresses to more than {limit} bytes; refusing to inflate it in "
+    "memory. If the trace is genuine, gunzip it and convert the .xt file."
+)
+# Xdebug >= 3.1 built with zlib compresses traces by default
+# (xdebug.use_compression=1) and appends .gz to the .xt name.
+TRACE_XDEBUG_SUFFIXES = (".xt", ".xt.gz")
 TRACE_XDEBUG_FORMAT_LINE = "File format: 4"
 TRACE_XDEBUG_MAIN = "{main}"
 TRACE_XDEBUG_GLUE_FUNCTIONS = frozenset(
@@ -194,6 +205,18 @@ TRACEBACK_NOTE_NOTHING_RESOLVED = (
     'e.g. {{"/app": "."}}.'
 )
 
+# An ExceptionGroup's report covers the group and, under `members`, each
+# sub-exception it printed (issue #3235).
+TRACEBACK_NOTE_EXCEPTION_GROUP = (
+    "{type} with {listed} sub-exception{plural}: frames is the stack that "
+    "raised the group, and each sub-exception is analysed on its own under "
+    "members."
+)
+TRACEBACK_NOTE_MEMBERS_OMITTED = (
+    " The traceback itself left out {omitted} more, past its "
+    "max_group_width or max_group_depth."
+)
+
 TRACE_ERR_BAD_HEADER = "Trace file {path} does not start with a valid cgr trace header."
 TRACE_ERR_VERSION = (
     "Trace file {path} has format version {found}; this build reads version {expected}."