codebeacon 0.4.0__tar.gz → 0.5.0__tar.gz

{codebeacon-0.4.0 → codebeacon-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebeacon
-Version: 0.4.0
+Version: 0.5.0
 Summary: Source code AST analysis tool for AI context generation — unified multi-framework knowledge graph
 Project-URL: Homepage, https://github.com/codebeacon/codebeacon
 Project-URL: Repository, https://github.com/codebeacon/codebeacon
@@ -98,6 +98,10 @@ Existing tools solve this partially. Route analyzers map your controllers but mi
 - **Deep-dive mode** — `--deep-dive` generates per-project `.codebeacon/` + `CLAUDE.md` for every sub-project; running `codebeacon scan . --update` from any sub-project folder automatically syncs all projects in the workspace
 - **Workspace auto-rediscovery** — on every `scan` / `sync`, codebeacon re-scans the workspace and appends any new project folders to `codebeacon.yaml` before extraction, so freshly added sub-projects are never silently skipped; pass `--no-rediscover` to opt out for hand-curated configs
 - **Graphify-style semantic enrichment** — after AST extraction, the skill dispatches one parallel subagent per chunk to emit `{nodes, edges, hyperedges}` with 8 relation types (`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) and EXTRACTED/INFERRED/AMBIGUOUS confidence; on Claude Code the subagent runs one tier below the host model (Opus→Sonnet, Sonnet→Haiku) so spend stays proportional to corpus size. AST owns code nodes; LLM only contributes `concept`/`document`/`paper` nodes. Existing 0.3.x archives replay through the new schema unchanged.
+- **Knowledge mode (`codebeacon knowledge`)** — scan markdown notes (ADRs, meeting notes, retros, specs, research) and produce a single `KNOWLEDGE.md` next to `.codebeacon/`. Auto-classifies by filename and heading patterns, parses Obsidian YAML frontmatter and `[[backlinks]]`, surfaces a top-level "Key Decisions" + "Open Questions" rollup so an agent learns *why* the codebase looks the way it does. Pure heuristics — no LLM call.
+- **Bare-path shortcut** — `codebeacon ./src` is now equivalent to `codebeacon scan ./src`; when the first argument isn't a registered subcommand, `scan` is auto-injected, so muscle memory from `graphify <path>` / `codesight <path>` works here too.
+- **Hardened semantic pipeline** — `semantic-apply` guards against malformed agent JSONL (null/list/code-fence lines, missing fields), coerces broken `confidence_score` values (None/NaN/string/out-of-range) to a safe default, snapshots `beacon.json` → `beacon.json.bak` before merging so the AST baseline is always recoverable, and regenerates `beacon.html` + `callflow.html` so visual exports reflect the newly-inferred edges.
+- **Sensitive file/dir guard** — `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` directories are always skipped; filenames matching credential patterns (`api_token`, `oauth_token`, `private_key`, `client_secret`; underscore *and* hyphen variants) are excluded from the source-file collector before they reach extractors.
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.de.md

@@ -57,6 +57,10 @@ Bestehende Tools lösen dieses Problem nur teilweise. Route-Analyzer erfassen Ih
 - **Deep-Dive-Modus** — `--deep-dive` erzeugt für jedes Sub-Projekt eigene `.codebeacon/` + `CLAUDE.md`; ein Update-Aufruf aus **beliebigem** Sub-Projekt-Ordner synchronisiert automatisch alle Projekte im Workspace
 - **Automatische Workspace-Wiedererkennung** — bei jedem `scan`/`sync` scannt codebeacon den Workspace erneut und hängt vor der Extraktion automatisch neue Projekte an die `codebeacon.yaml` an, sodass frisch hinzugefügte Sub-Projekte nicht unbemerkt übersprungen werden; `--no-rediscover` deaktiviert dies für handgepflegte Konfigurationen
 - **Graphify-artige Semantik-Anreicherung** — nach der AST-Extraktion dispatcht der Skill einen parallelen Subagenten pro Chunk, der vollständige Knowledge-Graph-Fragmente `{nodes, edges, hyperedges}` mit 8 Relationstypen (`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) und Konfidenz EXTRACTED/INFERRED/AMBIGUOUS erzeugt; auf Claude Code läuft der Subagent eine Stufe unter dem Host-Modell (Opus→Sonnet, Sonnet→Haiku), damit die Kosten proportional zur Korpus-Größe bleiben. Code-Knoten gehören dem AST; das LLM darf nur `concept`/`document`/`paper`-Knoten beisteuern. Bestehende 0.3.x-Archive werden unter dem neuen Schema unverändert wiedergegeben
+- **Wissensmodus (`codebeacon knowledge`)** — scannt Markdown-Notizen (ADRs, Meeting-Protokolle, Retros, Specs, Research) und erzeugt eine einzelne `KNOWLEDGE.md` neben `.codebeacon/`. Automatische Klassifizierung nach Dateinamen- und Überschriftenmustern, Parsing von Obsidian-YAML-Frontmatter und `[[backlinks]]`, sowie ein „Key Decisions" + „Open Questions"-Roll-up ganz oben, damit der Agent versteht, *warum* die Codebasis so aussieht, wie sie aussieht. Reine Heuristik — kein LLM-Aufruf
+- **Pfad-Kurzform** — `codebeacon ./src` ist jetzt äquivalent zu `codebeacon scan ./src`; wenn das erste Argument kein registrierter Sub-Befehl ist, wird `scan` automatisch eingefügt — die `graphify <path>` / `codesight <path>` Muskelerinnerung funktioniert genauso
+- **Gehärtete Semantik-Pipeline** — `semantic-apply` schützt vor fehlerhaftem Agent-JSONL (null/Listen/Code-Fence-Zeilen, fehlende Felder), coerced kaputte `confidence_score`-Werte (None/NaN/String/außerhalb des Bereichs) zu einem sicheren Default, snapshottet `beacon.json` → `beacon.json.bak` vor dem Merge, sodass die AST-Baseline jederzeit wiederherstellbar ist, und regeneriert `beacon.html` + `callflow.html`, damit die visuellen Exporte die neu inferierten Kanten reflektieren
+- **Schutzschienen für sensible Dateien/Verzeichnisse** — `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` werden immer übersprungen; Dateinamen, die Credential-Mustern entsprechen (`api_token`, `oauth_token`, `private_key`, `client_secret`; Underscore- *und* Bindestrich-Varianten) werden vom Collector vor den Extraktoren ausgeschlossen
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.es.md

@@ -57,6 +57,10 @@ Las herramientas existentes resuelven esto de forma parcial. Los analizadores de
 - **Modo Deep Dive** — `--deep-dive` genera `.codebeacon/` + `CLAUDE.md` propios para cada sub-proyecto; ejecutar el comando de actualización desde **cualquier** sub-proyecto sincroniza automáticamente todos los proyectos del workspace
 - **Auto-redescubrimiento del workspace** — en cada `scan`/`sync`, codebeacon re-escanea el workspace y añade automáticamente al `codebeacon.yaml` los nuevos proyectos antes de extraer, de modo que los sub-proyectos recién añadidos nunca se omitan silenciosamente; usa `--no-rediscover` para optar por el modo de configuración curada manualmente
 - **Enriquecimiento semántico estilo Graphify** — tras la extracción AST, el skill despacha un subagente paralelo por chunk para emitir fragmentos completos de grafo `{nodes, edges, hyperedges}` con 8 tipos de relación (`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) y confianza EXTRACTED/INFERRED/AMBIGUOUS; en Claude Code el subagente se ejecuta un nivel por debajo del modelo host (Opus→Sonnet, Sonnet→Haiku) para mantener el gasto proporcional al tamaño del corpus. El AST posee los nodos de código; el LLM solo puede aportar nodos `concept`/`document`/`paper`. Los archivos 0.3.x existentes se replayean con el nuevo esquema sin cambios
+- **Modo de conocimiento (`codebeacon knowledge`)** — escanea notas markdown (ADRs, actas de reunión, retros, specs, research) y produce un único `KNOWLEDGE.md` junto a `.codebeacon/`. Clasifica automáticamente por patrones de nombre de fichero y de encabezados, parsea frontmatter YAML de Obsidian y `[[backlinks]]`, y muestra arriba un resumen de "Key Decisions" + "Open Questions" para que el agente entienda *por qué* el código tiene la forma que tiene. Heurística pura — sin llamadas a LLM
+- **Atajo de ruta** — `codebeacon ./src` ahora equivale a `codebeacon scan ./src`; cuando el primer argumento no es un subcomando registrado, `scan` se inyecta automáticamente, conservando la memoria muscular de `graphify <path>` / `codesight <path>`
+- **Pipeline semántico endurecido** — `semantic-apply` protege contra JSONL del agente mal formado (líneas null/lista/code-fence, campos faltantes), coerce valores rotos de `confidence_score` (None/NaN/string/fuera de rango) a un default seguro, snapshotea `beacon.json` → `beacon.json.bak` antes del merge para que la baseline AST siempre sea recuperable, y regenera `beacon.html` + `callflow.html` para que los exports visuales reflejen los nuevos edges inferidos
+- **Guardas de ficheros/directorios sensibles** — los directorios `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` se omiten siempre; los nombres de fichero que coincidan con patrones de credenciales (`api_token`, `oauth_token`, `private_key`, `client_secret`; variantes con guion bajo *y* guion) quedan excluidos del recolector antes de llegar a los extractores
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.fr.md

@@ -57,6 +57,10 @@ Les outils existants ne résolvent ce problème qu'en partie. Les analyseurs de
 - **Mode Deep Dive** — `--deep-dive` génère un `.codebeacon/` + `CLAUDE.md` propre à chaque sous-projet ; une commande de mise à jour depuis **n'importe quel** sous-projet synchronise automatiquement tous les projets du workspace
 - **Redécouverte automatique du workspace** — à chaque `scan`/`sync`, codebeacon réanalyse le workspace et ajoute automatiquement les nouveaux projets au `codebeacon.yaml` avant l'extraction, de sorte que les sous-projets fraîchement ajoutés ne soient jamais oubliés en silence ; utilisez `--no-rediscover` pour conserver une configuration yaml gérée manuellement
 - **Enrichissement sémantique façon Graphify** — après l'extraction AST, le skill dispatche un sous-agent parallèle par chunk pour émettre des fragments complets de knowledge graph `{nodes, edges, hyperedges}` avec 8 types de relations (`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) et confiance EXTRACTED/INFERRED/AMBIGUOUS ; sur Claude Code, le sous-agent s'exécute un cran sous le modèle hôte (Opus→Sonnet, Sonnet→Haiku) pour garder le coût proportionnel à la taille du corpus. L'AST possède les nœuds de code ; le LLM ne peut contribuer que des nœuds `concept`/`document`/`paper`. Les archives 0.3.x existantes sont rejouées sous le nouveau schéma sans modification
+- **Mode connaissance (`codebeacon knowledge`)** — scanne les notes markdown (ADRs, comptes-rendus, rétros, specs, research) et produit un unique `KNOWLEDGE.md` à côté de `.codebeacon/`. Classification automatique par motifs de nom de fichier et de titres, parsing du frontmatter YAML Obsidian et des `[[backlinks]]`, et un résumé « Key Decisions » + « Open Questions » en tête pour que l'agent comprenne *pourquoi* la base de code a cette forme. Pure heuristique — sans appel LLM
+- **Raccourci chemin** — `codebeacon ./src` équivaut désormais à `codebeacon scan ./src` ; quand le premier argument n'est pas une sous-commande enregistrée, `scan` est injecté automatiquement, ce qui préserve la mémoire musculaire de `graphify <path>` / `codesight <path>`
+- **Pipeline sémantique durci** — `semantic-apply` protège contre les lignes JSONL mal formées de l'agent (null/listes/code-fences/champs manquants), coerce les valeurs cassées de `confidence_score` (None/NaN/string/hors-plage) vers un défaut sûr, snapshote `beacon.json` → `beacon.json.bak` avant le merge pour que la baseline AST reste toujours récupérable, et régénère `beacon.html` + `callflow.html` pour que les exports visuels reflètent les nouvelles arêtes inférées
+- **Garde-fous fichiers/dossiers sensibles** — les répertoires `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` sont toujours ignorés ; les noms de fichiers correspondant à des motifs de credentials (`api_token`, `oauth_token`, `private_key`, `client_secret` ; variantes avec underscore *et* tiret) sont exclus du collecteur avant d'atteindre les extracteurs
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.ja.md

@@ -57,6 +57,10 @@ AI コーディングセッションを新しく開くたびに、アシスタ
 - **ディープダイブモード** — `--deep-dive` で各サブプロジェクトに専用の `.codebeacon/` + `CLAUDE.md` を生成；**どのサブプロジェクトからでも**更新コマンドを実行するだけでワークスペース全体が自動同期
 - **ワークスペース自動再検出** — `scan`/`sync` 実行のたびにワークスペースを再スキャンし、`codebeacon.yaml` に未登録の新規プロジェクトを自動追加してから抽出を開始するため、新しく追加されたサブプロジェクトが見落とされることがない；yaml を手動で管理している場合は `--no-rediscover` でオプトアウト可能
 - **Graphify 風のセマンティック強化** — AST 抽出後、スキルがチャンクごとに 1 つのサブエージェントを並列でディスパッチし、`{nodes, edges, hyperedges}` のフル知識グラフ断片を抽出。関係 8 種（`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`）+ 信頼度 3 段階（EXTRACTED/INFERRED/AMBIGUOUS）をサポート。Claude Code ではサブエージェントがホストモデルより 1 段階下（Opus→Sonnet、Sonnet→Haiku）に自動ダウングレードされ、コーパスサイズに比例したコストを維持。コードノードは AST が担当し、LLM は `concept`/`document`/`paper` ノードのみ寄与可能。既存の 0.3.x アーカイブは新スキーマで透過的にリプレイされる
+- **ナレッジモード (`codebeacon knowledge`)** — マークダウンノート（ADR、議事録、ふりかえり、仕様、リサーチ）をスキャンし、`.codebeacon/` の隣に単一の `KNOWLEDGE.md` を生成。ファイル名・見出しパターンで自動分類、Obsidian の YAML frontmatter と `[[backlinks]]` をパースし、最上部に「Key Decisions」+「Open Questions」のロールアップを提示することで、コードベースが*なぜ*このような形になっているのかをエージェントに伝える。ヒューリスティックのみで LLM 呼び出しなし
+- **パス省略形** — `codebeacon ./src` が `codebeacon scan ./src` と等価に。先頭引数が登録済みサブコマンドでない場合は `scan` が自動注入されるため、`graphify <path>` / `codesight <path>` の操作感もそのまま使える
+- **強化された semantic パイプライン** — `semantic-apply` がエージェント JSONL の不正行（null/リスト/code-fence/必須フィールド欠落）をガードし、壊れた `confidence_score`（None/NaN/文字列/範囲外）を安全なデフォルトに coerce、merge 直前に `beacon.json` → `beacon.json.bak` をスナップショットして AST ベースラインを常に復元可能にし、`beacon.html`/`callflow.html` も再生成して新たに推論されたエッジが可視化に反映される
+- **機密ファイル・ディレクトリのガード** — `secrets/`、`credentials/`、`.ssh/`、`.aws/`、`.gnupg/` を常にスキップ。credential パターン（`api_token`、`oauth_token`、`private_key`、`client_secret`; アンダースコア*と*ハイフン両方の変種）に一致するファイル名は、抽出器に到達する前にコレクタ段階で除外
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.ko.md

@@ -57,6 +57,10 @@ AI 코딩 세션을 새로 열 때마다 어시스턴트는 백지 상태에서
 - **딥다이브 모드** — `--deep-dive`는 각 서브 프로젝트에 개별 `.codebeacon/` + `CLAUDE.md`를 생성; 어느 서브 프로젝트 폴더에서든 `codebeacon scan . --update`를 실행하면 워크스페이스의 모든 프로젝트가 자동으로 업데이트됨
 - **워크스페이스 자동 재발견** — `scan`/`sync` 실행마다 워크스페이스를 다시 훑어 `codebeacon.yaml`에 없는 신규 프로젝트를 자동으로 yaml에 추가한 뒤 추출 시작 — 새로 추가된 서브 프로젝트가 조용히 누락되지 않음; 수동으로 yaml을 큐레이션 중이라면 `--no-rediscover`로 옵트아웃
 - **Graphify 스타일 semantic 보강** — AST 추출 후 스킬이 청크당 subagent 1개를 병렬로 띄워 `{nodes, edges, hyperedges}` 풀 그래프 단편을 추출. 관계 8종(`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) + 신뢰도 3단계(EXTRACTED/INFERRED/AMBIGUOUS) 지원. Claude Code에서는 subagent가 호스트 모델보다 한 단계 아래(Opus→Sonnet, Sonnet→Haiku)로 자동 강등되어 코퍼스 크기에 비례한 비용 유지. 코드 노드는 AST 전담, LLM은 `concept`/`document`/`paper` 노드만 기여 가능. 기존 0.3.x 아카이브는 새 스키마로 그대로 replay됨
+- **지식 모드 (`codebeacon knowledge`)** — 마크다운 노트(ADR, 회의록, 회고, 스펙, 리서치)를 스캔해서 `.codebeacon/` 옆에 단일 `KNOWLEDGE.md` 생성. 파일명·제목 패턴으로 자동 분류, Obsidian YAML frontmatter와 `[[backlinks]]` 파싱, 최상단에 "Key Decisions" + "Open Questions" 롤업을 제공해 코드베이스가 *왜* 이런 모습인지 에이전트에게 전달. 휴리스틱만 사용 — LLM 호출 없음
+- **경로 단축 입력** — `codebeacon ./src`가 이제 `codebeacon scan ./src`와 동일. 첫 인자가 등록된 서브커맨드가 아니면 `scan`이 자동 주입되어, `graphify <path>` / `codesight <path>` 머슬 메모리도 그대로 동작
+- **강화된 semantic 파이프라인** — `semantic-apply`가 agent JSONL의 비정상 라인(null/리스트/code-fence/필수 필드 누락)을 가드, 잘못된 `confidence_score`(None/NaN/문자열/범위 초과)를 안전 기본값으로 coerce, merge 직전 `beacon.json` → `beacon.json.bak` 스냅샷으로 AST 베이스라인 복구 가능 보장, `beacon.html`/`callflow.html`도 재생성해서 새 inferred 엣지가 시각화에 반영됨
+- **민감 파일·디렉토리 가드** — `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` 디렉토리는 항상 스킵. credential 패턴(`api_token`, `oauth_token`, `private_key`, `client_secret`; 언더스코어 *및* 하이픈 변형) 파일명은 추출기에 도달하기 전 수집 단계에서 제외
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.md

@@ -55,6 +55,10 @@ Existing tools solve this partially. Route analyzers map your controllers but mi
 - **Deep-dive mode** — `--deep-dive` generates per-project `.codebeacon/` + `CLAUDE.md` for every sub-project; running `codebeacon scan . --update` from any sub-project folder automatically syncs all projects in the workspace
 - **Workspace auto-rediscovery** — on every `scan` / `sync`, codebeacon re-scans the workspace and appends any new project folders to `codebeacon.yaml` before extraction, so freshly added sub-projects are never silently skipped; pass `--no-rediscover` to opt out for hand-curated configs
 - **Graphify-style semantic enrichment** — after AST extraction, the skill dispatches one parallel subagent per chunk to emit `{nodes, edges, hyperedges}` with 8 relation types (`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) and EXTRACTED/INFERRED/AMBIGUOUS confidence; on Claude Code the subagent runs one tier below the host model (Opus→Sonnet, Sonnet→Haiku) so spend stays proportional to corpus size. AST owns code nodes; LLM only contributes `concept`/`document`/`paper` nodes. Existing 0.3.x archives replay through the new schema unchanged.
+- **Knowledge mode (`codebeacon knowledge`)** — scan markdown notes (ADRs, meeting notes, retros, specs, research) and produce a single `KNOWLEDGE.md` next to `.codebeacon/`. Auto-classifies by filename and heading patterns, parses Obsidian YAML frontmatter and `[[backlinks]]`, surfaces a top-level "Key Decisions" + "Open Questions" rollup so an agent learns *why* the codebase looks the way it does. Pure heuristics — no LLM call.
+- **Bare-path shortcut** — `codebeacon ./src` is now equivalent to `codebeacon scan ./src`; when the first argument isn't a registered subcommand, `scan` is auto-injected, so muscle memory from `graphify <path>` / `codesight <path>` works here too.
+- **Hardened semantic pipeline** — `semantic-apply` guards against malformed agent JSONL (null/list/code-fence lines, missing fields), coerces broken `confidence_score` values (None/NaN/string/out-of-range) to a safe default, snapshots `beacon.json` → `beacon.json.bak` before merging so the AST baseline is always recoverable, and regenerates `beacon.html` + `callflow.html` so visual exports reflect the newly-inferred edges.
+- **Sensitive file/dir guard** — `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` directories are always skipped; filenames matching credential patterns (`api_token`, `oauth_token`, `private_key`, `client_secret`; underscore *and* hyphen variants) are excluded from the source-file collector before they reach extractors.
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.pt-BR.md

@@ -57,6 +57,10 @@ As ferramentas existentes resolvem isso apenas parcialmente. Analisadores de rot
 - **Modo Deep Dive** — `--deep-dive` gera `.codebeacon/` + `CLAUDE.md` próprios para cada sub-projeto; executar o comando de atualização de **qualquer** sub-projeto sincroniza automaticamente todos os projetos do workspace
 - **Auto-redescoberta do workspace** — a cada `scan`/`sync`, o codebeacon re-escaneia o workspace e adiciona automaticamente os novos projetos ao `codebeacon.yaml` antes da extração, evitando que sub-projetos recém-criados sejam silenciosamente ignorados; use `--no-rediscover` para manter uma configuração yaml curada manualmente
 - **Enriquecimento semântico estilo Graphify** — após a extração AST, o skill despacha um subagente paralelo por chunk para emitir fragmentos completos de knowledge graph `{nodes, edges, hyperedges}` com 8 tipos de relação (`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`) e confiança EXTRACTED/INFERRED/AMBIGUOUS; no Claude Code o subagente roda um nível abaixo do modelo host (Opus→Sonnet, Sonnet→Haiku) para manter o custo proporcional ao tamanho do corpus. O AST é dono dos nós de código; o LLM só pode contribuir nós `concept`/`document`/`paper`. Os arquivos 0.3.x existentes são replayados sob o novo esquema sem alteração
+- **Modo de conhecimento (`codebeacon knowledge`)** — escaneia notas markdown (ADRs, atas de reunião, retros, specs, research) e gera um único `KNOWLEDGE.md` ao lado de `.codebeacon/`. Classificação automática por padrões de nome de arquivo e cabeçalhos, parsing de frontmatter YAML do Obsidian e `[[backlinks]]`, e um resumo de "Key Decisions" + "Open Questions" no topo para que o agente entenda *por que* o código tem a forma que tem. Heurística pura — sem chamadas a LLM
+- **Atalho de caminho** — `codebeacon ./src` agora equivale a `codebeacon scan ./src`; quando o primeiro argumento não é um subcomando registrado, `scan` é auto-injetado, mantendo a memória muscular de `graphify <path>` / `codesight <path>`
+- **Pipeline semântico endurecido** — `semantic-apply` protege contra JSONL do agente malformado (linhas null/lista/code-fence, campos faltando), coerce valores quebrados de `confidence_score` (None/NaN/string/fora do range) para um default seguro, faz snapshot `beacon.json` → `beacon.json.bak` antes do merge para manter a baseline AST sempre recuperável, e regenera `beacon.html` + `callflow.html` para que os exports visuais reflitam as novas arestas inferidas
+- **Guards de arquivos/diretórios sensíveis** — os diretórios `secrets/`, `credentials/`, `.ssh/`, `.aws/`, `.gnupg/` são sempre ignorados; nomes de arquivo que combinem com padrões de credenciais (`api_token`, `oauth_token`, `private_key`, `client_secret`; variantes com underscore *e* hífen) são excluídos do coletor antes de chegarem aos extractors
 
 ---
 

{codebeacon-0.4.0 → codebeacon-0.5.0}/README.zh-CN.md

@@ -57,6 +57,10 @@
 - **深度扫描模式** — `--deep-dive` 为每个子项目生成专属 `.codebeacon/` + `CLAUDE.md`；从**任意**子项目目录执行更新命令，即可自动同步整个工作区的所有项目
 - **工作区自动重新发现** — 每次执行 `scan`/`sync` 时,codebeacon 会重新扫描工作区,并将 `codebeacon.yaml` 中尚未登记的新项目自动追加后再进行抽取,新增子项目不会被静默跳过;若手动维护 yaml,可通过 `--no-rediscover` 退出此行为
 - **Graphify 风格的语义增强** — AST 抽取后,技能会按 chunk 并行派发一个 subagent,各自生成 `{nodes, edges, hyperedges}` 的完整知识图谱片段。支持 8 种关系(`calls`/`implements`/`references`/`cites`/`conceptually_related_to`/`shares_data_with`/`semantically_similar_to`/`rationale_for`)与三级置信度(EXTRACTED/INFERRED/AMBIGUOUS)。在 Claude Code 中,subagent 会自动降级到比宿主模型低一级(Opus→Sonnet、Sonnet→Haiku),让花费与语料规模成比例。代码节点由 AST 独占,LLM 仅可贡献 `concept`/`document`/`paper` 节点。已有的 0.3.x 归档可透明地在新 schema 下重放
+- **知识模式 (`codebeacon knowledge`)** — 扫描 Markdown 笔记(ADR、会议记录、复盘、规格、调研)在 `.codebeacon/` 旁生成单一 `KNOWLEDGE.md`。按文件名 / 标题模式自动分类,解析 Obsidian YAML frontmatter 与 `[[backlinks]]`,顶部提供 "Key Decisions" + "Open Questions" 汇总,让 agent 了解代码库*为什么*长成这样。纯启发式,不调用 LLM
+- **路径简写** — `codebeacon ./src` 现等价于 `codebeacon scan ./src`;首参数不是已注册子命令时会自动注入 `scan`,沿用 `graphify <path>` / `codesight <path>` 的手感
+- **加固的 semantic 流水线** — `semantic-apply` 会拦截 agent JSONL 中的异常行(null / 数组 / code-fence / 缺少必要字段),将损坏的 `confidence_score`(None / NaN / 字符串 / 越界)coerce 为安全默认值,在合并前对 `beacon.json` → `beacon.json.bak` 做快照确保 AST 基线始终可恢复,并重新生成 `beacon.html` / `callflow.html`,让新推断的边在可视化中体现
+- **敏感文件 / 目录护栏** — `secrets/`、`credentials/`、`.ssh/`、`.aws/`、`.gnupg/` 始终跳过;符合凭证模式(`api_token`、`oauth_token`、`private_key`、`client_secret`;下划线*与*连字符变体)的文件名在到达抽取器之前就在收集阶段排除
 
 ---
 

codebeacon-0.5.0/codebeacon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{codebeacon-0.4.0 → codebeacon-0.5.0}/codebeacon/cli.py

@@ -709,6 +709,39 @@ def _cmd_hook(args: argparse.Namespace) -> int:
     return install_hooks(target)
 
 
+def _cmd_knowledge(args: argparse.Namespace) -> int:
+    """``codebeacon knowledge`` — scan markdown notes → ``KNOWLEDGE.md``.
+
+    Pairs with the existing ``codebeacon scan`` (code → graph). The two
+    outputs together give an agent both *what* the code does and *why*
+    the team decided to build it this way (see codesight 1.9.3
+    ``--mode knowledge`` for the original framing).
+    """
+    from codebeacon.knowledge import build_knowledge_map
+
+    root = Path(args.path or ".").resolve()
+    if not root.exists():
+        print(f"  Error: path not found: {root}", file=sys.stderr)
+        return 1
+    if not root.is_dir():
+        print(f"  Error: not a directory: {root}", file=sys.stderr)
+        return 1
+
+    output_dir = Path(args.output_dir).resolve() if args.output_dir else root
+
+    print(f"  Scanning markdown notes under {root} ...")
+    result = build_knowledge_map(root, output_dir)
+    counts = result.counts()
+    total = len(result.notes)
+    print(f"    {total} notes found")
+    if counts:
+        bits = ", ".join(f"{v} {k}" for k, v in sorted(counts.items()))
+        print(f"    Categories: {bits}")
+    if result.output_path:
+        print(f"  Wrote {result.output_path}")
+    return 0
+
+
 def _cmd_serve(args: argparse.Namespace) -> int:
     from pathlib import Path
     from codebeacon.export.mcp import serve
@@ -985,6 +1018,21 @@ def build_parser() -> argparse.ArgumentParser:
     md_p.add_argument("other", help="Path to other branch's version")
     md_p.set_defaults(func=_cmd_merge_driver)
 
+    # knowledge — map .md notes (ADRs, meetings, retros, specs) into KNOWLEDGE.md
+    knowledge_p = sub.add_parser(
+        "knowledge",
+        help="Scan markdown notes (ADRs, meetings, retros, specs) → KNOWLEDGE.md",
+    )
+    knowledge_p.add_argument(
+        "path", nargs="?", default=".",
+        help="Directory to scan recursively (default: cwd)",
+    )
+    knowledge_p.add_argument(
+        "--output-dir", metavar="DIR", default=None,
+        help="Where to write KNOWLEDGE.md (default: scanned path)",
+    )
+    knowledge_p.set_defaults(func=_cmd_knowledge)
+
     # hook install
     hook_p = sub.add_parser("hook", help="Install git hooks + merge driver in the current repo")
     hook_sub = hook_p.add_subparsers(dest="hook_action", metavar="<action>")
@@ -996,7 +1044,35 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+# Known subcommands — used by main() to decide whether a bare first arg should
+# be auto-dispatched to ``scan``. Keep this in sync with ``build_parser()``.
+_KNOWN_SUBCOMMANDS: set[str] = {
+    "scan", "sync", "init", "query", "path", "serve", "install", "upgrade",
+    "semantic-prepare", "semantic-apply", "merge-driver", "hook", "knowledge",
+}
+
+
+def _maybe_inject_scan(argv: list[str]) -> list[str]:
+    """If the first positional arg is a path-like value, prepend ``scan``.
+
+    Mirrors graphify's ``graphify <path>`` shortcut. Anything starting with
+    ``-`` is a flag, anything in ``_KNOWN_SUBCOMMANDS`` is a real subcommand,
+    and ``--version``/``--help`` are left alone. Everything else (a path, a
+    URL, or a typo) becomes ``scan <arg>`` so users don't see an unfriendly
+    ``unknown command`` error for the most common invocation.
+    """
+    if not argv:
+        return argv
+    first = argv[0]
+    if first in _KNOWN_SUBCOMMANDS:
+        return argv
+    if first.startswith("-"):
+        return argv
+    return ["scan", *argv]
+
+
 def main() -> None:
     parser = build_parser()
-    args = parser.parse_args()
+    argv = _maybe_inject_scan(sys.argv[1:])
+    args = parser.parse_args(argv)
     sys.exit(args.func(args))

{codebeacon-0.4.0 → codebeacon-0.5.0}/codebeacon/discover/scanner.py

@@ -46,8 +46,59 @@ IGNORE_DIRS: set[str] = {
     ".bundle",          # Ruby bundler
     "public",           # usually static assets
     ".terraform",
+    # Sensitive credential / secret directories — always skip even when they
+    # don't start with `.` (so the hidden-dir rule below doesn't cover them).
+    # Mirrors graphify's _SENSITIVE_DIRS hardening (graphify 0.8.12).
+    "secrets",
+    "credentials",
+    ".ssh",
+    ".aws",
+    ".gnupg",
 }
 
+# File basenames that should never be indexed even if their extension matches
+# CODE_EXTENSIONS — they almost certainly hold credentials. Underscore-prefixed
+# variants (api_token.txt, oauth_token.json) are also caught by the regex in
+# ``_is_sensitive_filename`` so we don't need to enumerate every spelling.
+_SENSITIVE_BASENAMES: set[str] = {
+    "credentials",
+    "credentials.json",
+    "credentials.yaml",
+    "credentials.yml",
+    "service-account.json",
+    "id_rsa",
+    "id_ed25519",
+    "id_ecdsa",
+}
+
+# Substring (with word-boundary or underscore boundary) match for sensitive
+# tokens in file basenames: ``api_token.txt``, ``OAuth_Token.json``,
+# ``slack-secret.yml``, ``private_key.pem`` — anything that mentions a
+# credential keyword should be skipped even if the extension is otherwise a
+# code one (e.g. ``.json`` for Cargo manifests). The pattern is intentionally
+# narrow: it must be at the start of the basename or follow ``[-_.]`` so we
+# don't match e.g. ``token_bucket.ts`` or ``mysecretweapon.ts``.
+import re as _re
+_SENSITIVE_NAME_RE = _re.compile(
+    r"(?:^|[-_.])(?:api[-_]?key|api[-_]?token|oauth[-_]?token|"
+    r"access[-_]?token|refresh[-_]?token|secret[-_]?key|"
+    r"private[-_]?key|client[-_]?secret)"
+    r"(?=[-_.]|$)",
+    _re.IGNORECASE,
+)
+
+
+def _is_sensitive_filename(name: str) -> bool:
+    """Return True if ``name`` looks like a credential file.
+
+    Used at file-collection time to skip secrets that happen to share an
+    extension with code (e.g. ``service-account.json``, ``api_token.txt``).
+    """
+    lower = name.lower()
+    if lower in _SENSITIVE_BASENAMES:
+        return True
+    return _SENSITIVE_NAME_RE.search(lower) is not None
+
 CODE_EXTENSIONS: set[str] = {
     ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",
     ".py",
@@ -151,6 +202,8 @@ def _walk(
         elif entry.is_file():
             if entry.suffix not in CODE_EXTENSIONS:
                 continue
+            if _is_sensitive_filename(entry.name):
+                continue
             if matcher.is_ignored(rel, is_dir=False):
                 continue
             result.append(str(entry))

codebeacon-0.5.0/codebeacon/knowledge/__init__.py

@@ -0,0 +1,16 @@
+"""Knowledge map: ``.md`` notes → ``KNOWLEDGE.md``.
+
+Ports the codesight 1.9.3 ``--mode knowledge`` feature: scans markdown files
+under a directory (ADR-style decision records, meeting notes, retrospectives,
+specs/PRDs, research notes, Obsidian vault entries) and produces a single
+compact ``KNOWLEDGE.md`` primer next to ``.codebeacon/``.
+
+Public entry point:
+
+    from codebeacon.knowledge import build_knowledge_map
+    result = build_knowledge_map(root, output_dir)
+"""
+
+from codebeacon.knowledge.generator import build_knowledge_map, KnowledgeResult
+
+__all__ = ["build_knowledge_map", "KnowledgeResult"]