codebeacon 0.6.5__tar.gz → 0.6.7__tar.gz

{codebeacon-0.6.5 → codebeacon-0.6.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codebeacon
-Version: 0.6.5
+Version: 0.6.7
 Summary: Source code AST analysis tool for AI context generation — unified multi-framework knowledge graph
 Project-URL: Homepage, https://github.com/codebeacon/codebeacon
 Project-URL: Repository, https://github.com/codebeacon/codebeacon
@@ -20,75 +20,75 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Requires-Dist: networkx>=3.0
 Requires-Dist: pyyaml>=6.0
-Requires-Dist: tree-sitter-javascript>=0.23
-Requires-Dist: tree-sitter-python>=0.23
-Requires-Dist: tree-sitter-typescript>=0.23
-Requires-Dist: tree-sitter>=0.23
+Requires-Dist: tree-sitter-javascript<0.26,>=0.23
+Requires-Dist: tree-sitter-python<0.26,>=0.23
+Requires-Dist: tree-sitter-typescript<0.24,>=0.23
+Requires-Dist: tree-sitter<0.26,>=0.23
 Provides-Extra: backend
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-go>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-java>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-php>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'backend'
 Provides-Extra: cluster
 Requires-Dist: graspologic>=1.0; extra == 'cluster'
 Provides-Extra: csharp
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'csharp'
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'csharp'
 Provides-Extra: dev
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-go>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-html>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-java>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-php>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'dev'
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'dev'
 Provides-Extra: dotnet
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'dotnet'
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'dotnet'
 Provides-Extra: full
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-go>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-html>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-java>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-php>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'full'
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'full'
 Provides-Extra: go
-Requires-Dist: tree-sitter-go>=0.23; extra == 'go'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'go'
 Provides-Extra: html
-Requires-Dist: tree-sitter-html>=0.23; extra == 'html'
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'html'
 Provides-Extra: java
-Requires-Dist: tree-sitter-java>=0.23; extra == 'java'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'java'
 Provides-Extra: jvm
-Requires-Dist: tree-sitter-java>=0.23; extra == 'jvm'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'jvm'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'jvm'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'jvm'
 Provides-Extra: kotlin
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'kotlin'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'kotlin'
 Provides-Extra: mobile
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'mobile'
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'mobile'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'mobile'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'mobile'
 Provides-Extra: php
-Requires-Dist: tree-sitter-php>=0.23; extra == 'php'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'php'
 Provides-Extra: ruby
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'ruby'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'ruby'
 Provides-Extra: rust
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'rust'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'rust'
 Provides-Extra: svelte
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'svelte'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'svelte'
 Provides-Extra: swift
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'swift'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'swift'
 Provides-Extra: web
-Requires-Dist: tree-sitter-html>=0.23; extra == 'web'
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'web'
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'web'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'web'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -118,6 +118,29 @@ Description-Content-Type: text/markdown
 
 ---
 
+## What's new in 0.6.7
+
+Follow-ups to the 0.6.6 graphify-parity audit: grammar drift now fails loudly instead of silently, and ignore-file negations no longer slow scans down.
+
+- **Grammar drift is a loud failure, not a silent empty graph** — when a tree-sitter query can't compile against a grammar it's *supposed* to support (e.g. a node-type rename in a future grammar bump), `run_query` now raises and the file is recorded as an `ExtractionFailure` instead of silently extracting nothing. Together with the 0.6.6 upper-bound pins and the "every query compiles against every grammar it claims" test, drift is now caught three independent ways.
+- **A single `!` negation in `.codebeaconignore` no longer forces a full-tree walk** — one negation rule anywhere used to disable directory pruning *everywhere*, so the scanner descended into every excluded directory (`node_modules`, `build`, …) even when the negation couldn't possibly rescue anything there. Each ignored directory is now kept only if a negation could actually re-include a file beneath *it*; unrelated `!` rules cost nothing.
+- **Ignore globs compile once** — the gitignore-style matcher memoizes each pattern's compiled regex instead of rebuilding it on every path check, speeding up discovery on deep trees with large ignore files. (Semantics unchanged.)
+
+---
+
+## What's new in 0.6.6
+
+A graphify-parity audit of upstream v0.8.37–v0.8.40 (and reported issues through #1362): a verify-then-adversarially-refute sweep of 32 candidates confirmed **6 real bugs**. The headline — three framework extractors were silently producing *nothing*.
+
+- **TypeScript Express / Koa / Fastify apps now extract routes** — `express.scm` hard-coded the JavaScript class-name node type, which is an "Impossible pattern" under the TypeScript grammar, so the whole query failed to compile and the error was swallowed: **TS Express apps extracted 0 routes**. (JavaScript apps worked, and the only test fixture was `.js`, so it went unnoticed.) The identical root cause hit `vue.scm` (Vue SFCs with a plain `<script>` → 0 components). Both now use a grammar-neutral node wildcard that compiles under JS and TS.
+- **Kotlin files in Spring projects no longer error** — `spring_boot.scm` is a Java-grammar query but was allowed to run against Kotlin, emitting `Invalid node type: marker_annotation` and dropping every `.kt` file. Kotlin is now gated off cleanly (Kotlin Spring Boot would need its own query).
+- **Tree-sitter grammars are pinned with upper bounds** — `pyproject.toml` pinned grammars open-ended (`>=0.23`), so a future grammar release that renames AST node types could silently re-break the queries. Every grammar now has a compatible-range ceiling, and a new test asserts every shipped `.scm` compiles against every grammar it claims to support.
+- **The extraction cache is versioned** — after upgrading codebeacon, an incremental `--update` could reuse results extracted by the *old* version for unchanged files (a content hash can't detect that the extractor itself changed). The cache is now stamped with the codebeacon version and discarded on mismatch.
+- **Accented / non-ASCII names resolve on macOS** — `codebeacon query` / `path` / MCP and `affected` now Unicode-NFC-normalise labels and paths, so a name copied from a macOS filename (stored as NFD) matches the NFC label in the graph (e.g. `Auditoría`).
+- Plus: a corrupt extraction `cache.json` is backed up and rebuilt instead of being silently reset and then overwritten.
+
+---
+
 ## What's new in 0.6.5
 
 `codebeacon upgrade` now works everywhere — it previously assumed a plain pip install and died silently on machines where that wasn't true.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.de.md

@@ -27,6 +27,29 @@
 
 ---
 
+## Neu in 0.6.7
+
+Folgearbeiten zum graphify-Parity-Audit aus 0.6.6: Grammar-Drift schlägt jetzt laut fehl statt stillschweigend, und Negationen in der Ignore-Datei verlangsamen Scans nicht mehr.
+
+- **Grammar-Drift ist ein lauter Fehler, kein stiller leerer Graph** — wenn eine tree-sitter-Query gegen eine Grammar, die sie unterstützen *soll*, nicht kompiliert (z. B. eine umbenannte Node-Art in einem künftigen Grammar-Update), wirft `run_query` jetzt eine Ausnahme und die Datei wird als `ExtractionFailure` erfasst, statt still nichts zu extrahieren. Zusammen mit den Obergrenzen-Pins aus 0.6.6 und dem Test „jede Query kompiliert gegen jede Grammar, die sie beansprucht" wird Drift nun auf drei unabhängige Weisen erkannt.
+- **Eine einzelne `!`-Negation in `.codebeaconignore` erzwingt keinen vollständigen Baum-Durchlauf mehr** — eine Negationsregel irgendwo hat das Verzeichnis-Pruning *überall* deaktiviert, sodass der Scanner in jedes ausgeschlossene Verzeichnis (`node_modules`, `build`, …) hinabstieg, selbst wenn die Negation dort nichts retten konnte. Ein ignoriertes Verzeichnis wird jetzt nur behalten, wenn eine Negation tatsächlich eine Datei *darunter* wieder einschließen könnte; nicht zugehörige `!`-Regeln kosten nichts.
+- **Ignore-Globs werden einmal kompiliert** — der gitignore-artige Matcher merkt sich die kompilierte Regex je Muster, statt sie bei jeder Pfadprüfung neu zu bauen (schnellere Erkennung bei tiefen Bäumen mit großen Ignore-Dateien). Semantik unverändert.
+
+---
+
+## Neu in 0.6.6
+
+Ein graphify-Parity-Audit von Upstream v0.8.37–v0.8.40 (und gemeldeten Issues bis #1362): ein „prüfen, dann adversarial widerlegen"-Durchlauf über 32 Kandidaten bestätigte **6 echte Bugs**. Der Hauptpunkt — drei Framework-Extraktoren produzierten still *nichts*.
+
+- **TypeScript-Express/Koa/Fastify-Apps extrahieren jetzt Routen** — `express.scm` hatte die JavaScript-Node-Art für Klassennamen fest verdrahtet, was unter der TypeScript-Grammar ein „Impossible pattern" ist; die gesamte Query kompilierte nicht und der Fehler wurde verschluckt: **TS-Express-Apps extrahierten 0 Routen**. (JavaScript-Apps funktionierten, und die einzige Test-Fixture war `.js`, daher blieb es unbemerkt.) Dieselbe Ursache traf `vue.scm` (Vue-SFCs mit reinem `<script>` → 0 Komponenten). Beide nutzen jetzt einen grammar-neutralen Node-Wildcard, der unter JS und TS kompiliert.
+- **Kotlin-Dateien in Spring-Projekten verursachen keinen Fehler mehr** — `spring_boot.scm` ist eine Java-Grammar-Query, durfte aber gegen Kotlin laufen und gab `Invalid node type: marker_annotation` aus, wobei jede `.kt`-Datei verworfen wurde. Kotlin wird jetzt sauber ausgeschlossen (Kotlin-Spring-Boot bräuchte eine eigene Query).
+- **tree-sitter-Grammars haben jetzt Versions-Obergrenzen** — `pyproject.toml` pinnte Grammars nach oben offen (`>=0.23`), sodass ein künftiges Grammar-Release, das AST-Node-Arten umbenennt, die Queries still wieder hätte brechen können. Jede Grammar hat nun eine kompatible Obergrenze, und ein neuer Test prüft, dass jede ausgelieferte `.scm` gegen jede beanspruchte Grammar kompiliert.
+- **Der Extraktions-Cache ist versioniert** — nach einem Upgrade konnte ein inkrementelles `--update` für unveränderte Dateien Ergebnisse der *alten* Version wiederverwenden (ein Content-Hash erkennt nicht, dass sich der Extraktor geändert hat). Der Cache trägt jetzt die codebeacon-Version und wird bei Abweichung verworfen.
+- **Akzentuierte / Nicht-ASCII-Namen werden unter macOS aufgelöst** — `codebeacon query` / `path` / MCP und `affected` normalisieren Labels und Pfade jetzt nach Unicode-NFC, sodass ein aus einem macOS-Dateinamen (als NFD gespeichert) kopierter Name das NFC-Label im Graphen trifft (z. B. `Auditoría`).
+- Außerdem: eine beschädigte `cache.json` wird gesichert und neu aufgebaut, statt still zurückgesetzt und überschrieben zu werden.
+
+---
+
 ## Neu in 0.6.5
 
 `codebeacon upgrade` funktioniert jetzt überall — bisher ging der Befehl von einer normalen pip-Installation aus und scheiterte auf anderen Maschinen stillschweigend.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.es.md

@@ -27,6 +27,29 @@
 
 ---
 
+## Novedades en 0.6.7
+
+Seguimiento de la auditoría de paridad con graphify de 0.6.6: la deriva de gramática ahora falla de forma ruidosa en lugar de silenciosa, y las negaciones en el archivo de ignore ya no ralentizan los escaneos.
+
+- **La deriva de gramática es un fallo ruidoso, no un grafo vacío silencioso** — cuando una query de tree-sitter no compila contra una gramática que *debería* soportar (p. ej. un nodo renombrado en una futura actualización de gramática), `run_query` ahora lanza una excepción y el archivo se registra como `ExtractionFailure` en lugar de extraer silenciosamente nada. Junto con los topes superiores de 0.6.6 y el test «cada query compila contra cada gramática que declara soportar», la deriva se detecta ahora de tres formas independientes.
+- **Una sola negación `!` en `.codebeaconignore` ya no fuerza un recorrido completo del árbol** — una regla de negación en cualquier sitio desactivaba el pruning de directorios *en todas partes*, así que el escáner descendía a cada directorio excluido (`node_modules`, `build`, …) aunque la negación no pudiera rescatar nada allí. Ahora un directorio ignorado solo se conserva si una negación realmente podría reincluir un archivo *debajo de él*; las reglas `!` no relacionadas no cuestan nada.
+- **Los globs de ignore se compilan una sola vez** — el matcher estilo gitignore memoiza la regex compilada por patrón en lugar de reconstruirla en cada comprobación de ruta (descubrimiento más rápido en árboles profundos con archivos de ignore grandes). La semántica no cambia.
+
+---
+
+## Novedades en 0.6.6
+
+Una auditoría de paridad con graphify de upstream v0.8.37–v0.8.40 (e issues reportados hasta #1362): un barrido de «verificar y luego refutar de forma adversaria» sobre 32 candidatos confirmó **6 bugs reales**. Lo principal: tres extractores de framework producían silenciosamente *nada*.
+
+- **Las apps de Express/Koa/Fastify en TypeScript ahora extraen rutas** — `express.scm` fijaba el nodo de nombre de clase de JavaScript, que es un «Impossible pattern» bajo la gramática de TypeScript, así que toda la query no compilaba y el error se tragaba: **las apps de Express en TS extraían 0 rutas**. (Las apps de JavaScript funcionaban, y la única fixture de test era `.js`, así que pasó desapercibido.) La misma causa afectaba a `vue.scm` (SFC de Vue con `<script>` plano → 0 componentes). Ambos usan ahora un comodín de nodo neutral a la gramática que compila en JS y TS.
+- **Los archivos Kotlin en proyectos Spring ya no dan error** — `spring_boot.scm` es una query de gramática Java pero se permitía ejecutarla contra Kotlin, emitiendo `Invalid node type: marker_annotation` y descartando cada archivo `.kt`. Kotlin ahora se bloquea limpiamente (Kotlin Spring Boot necesitaría su propia query).
+- **Las gramáticas de tree-sitter están fijadas con topes superiores** — `pyproject.toml` fijaba las gramáticas sin límite superior (`>=0.23`), así que un futuro release de gramática que renombrara nodos del AST podría romper las queries de nuevo en silencio. Cada gramática tiene ahora un tope de rango compatible, y un nuevo test verifica que cada `.scm` distribuida compila contra cada gramática que declara soportar.
+- **La caché de extracción está versionada** — tras actualizar codebeacon, un `--update` incremental podía reutilizar resultados extraídos por la versión *antigua* para archivos sin cambios (un hash de contenido no detecta que el extractor cambió). La caché ahora lleva la versión de codebeacon y se descarta si no coincide.
+- **Los nombres acentuados / no ASCII se resuelven en macOS** — `codebeacon query` / `path` / MCP y `affected` ahora normalizan etiquetas y rutas a Unicode NFC, de modo que un nombre copiado de un nombre de archivo de macOS (guardado como NFD) coincide con la etiqueta NFC del grafo (p. ej. `Auditoría`).
+- Además: una `cache.json` corrupta se respalda y se reconstruye en lugar de resetearse y sobrescribirse en silencio.
+
+---
+
 ## Novedades en 0.6.5
 
 `codebeacon upgrade` ahora funciona en cualquier entorno — antes asumía una instalación pip normal y fallaba silenciosamente en máquinas donde no lo era.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.fr.md

@@ -27,6 +27,29 @@
 
 ---
 
+## Nouveautés en 0.6.7
+
+Suite de l'audit de parité graphify de 0.6.6 : la dérive de grammaire échoue désormais bruyamment au lieu de silencieusement, et les négations du fichier d'ignore ne ralentissent plus les scans.
+
+- **La dérive de grammaire est un échec bruyant, pas un graphe vide silencieux** — quand une requête tree-sitter ne compile pas contre une grammaire qu'elle est *censée* prendre en charge (p. ex. un nœud renommé dans une future mise à jour de grammaire), `run_query` lève désormais une exception et le fichier est enregistré comme `ExtractionFailure` au lieu de n'extraire silencieusement rien. Avec les bornes supérieures de 0.6.6 et le test « chaque requête compile contre chaque grammaire qu'elle revendique », la dérive est désormais détectée de trois façons indépendantes.
+- **Une seule négation `!` dans `.codebeaconignore` ne force plus un parcours complet de l'arbre** — une règle de négation où que ce soit désactivait l'élagage des répertoires *partout*, de sorte que le scanner descendait dans chaque répertoire exclu (`node_modules`, `build`, …) même si la négation ne pouvait rien y récupérer. Un répertoire ignoré n'est désormais conservé que si une négation pourrait réellement réinclure un fichier *en dessous* ; les règles `!` non liées ne coûtent rien.
+- **Les globs d'ignore sont compilés une seule fois** — le matcher de style gitignore mémorise la regex compilée par motif au lieu de la reconstruire à chaque vérification de chemin (découverte plus rapide sur les arbres profonds avec de gros fichiers d'ignore). Sémantique inchangée.
+
+---
+
+## Nouveautés en 0.6.6
+
+Un audit de parité graphify de l'upstream v0.8.37–v0.8.40 (et des issues signalées jusqu'à #1362) : un balayage « vérifier puis réfuter de façon adverse » sur 32 candidats a confirmé **6 vrais bugs**. L'essentiel — trois extracteurs de framework ne produisaient silencieusement *rien*.
+
+- **Les apps Express/Koa/Fastify en TypeScript extraient désormais des routes** — `express.scm` codait en dur le nœud de nom de classe de JavaScript, qui est un « Impossible pattern » sous la grammaire TypeScript ; toute la requête ne compilait pas et l'erreur était avalée : **les apps Express en TS extrayaient 0 route**. (Les apps JavaScript fonctionnaient, et la seule fixture de test était `.js`, donc c'est passé inaperçu.) La même cause touchait `vue.scm` (SFC Vue avec `<script>` simple → 0 composant). Les deux utilisent désormais un joker de nœud neutre vis-à-vis de la grammaire qui compile en JS et TS.
+- **Les fichiers Kotlin dans les projets Spring ne provoquent plus d'erreur** — `spring_boot.scm` est une requête de grammaire Java mais était autorisée à s'exécuter contre Kotlin, émettant `Invalid node type: marker_annotation` et écartant chaque fichier `.kt`. Kotlin est désormais proprement bloqué (Kotlin Spring Boot nécessiterait sa propre requête).
+- **Les grammaires tree-sitter sont épinglées avec des bornes supérieures** — `pyproject.toml` épinglait les grammaires sans limite supérieure (`>=0.23`), de sorte qu'une future version de grammaire renommant des nœuds de l'AST pouvait à nouveau casser les requêtes en silence. Chaque grammaire a désormais un plafond de plage compatible, et un nouveau test vérifie que chaque `.scm` livrée compile contre chaque grammaire qu'elle revendique.
+- **Le cache d'extraction est versionné** — après une mise à jour de codebeacon, un `--update` incrémental pouvait réutiliser des résultats extraits par l'*ancienne* version pour des fichiers inchangés (un hash de contenu ne détecte pas que l'extracteur a changé). Le cache porte désormais la version de codebeacon et est rejeté en cas de divergence.
+- **Les noms accentués / non-ASCII se résolvent sous macOS** — `codebeacon query` / `path` / MCP et `affected` normalisent désormais les libellés et chemins en Unicode NFC, de sorte qu'un nom copié depuis un nom de fichier macOS (stocké en NFD) correspond au libellé NFC dans le graphe (p. ex. `Auditoría`).
+- De plus : un `cache.json` corrompu est sauvegardé et reconstruit au lieu d'être silencieusement réinitialisé puis écrasé.
+
+---
+
 ## Nouveautés en 0.6.5
 
 `codebeacon upgrade` fonctionne désormais partout — il supposait auparavant une installation pip classique et échouait silencieusement sur les machines où ce n'était pas le cas.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.ja.md

@@ -27,6 +27,29 @@
 
 ---
 
+## 0.6.7 の新機能
+
+0.6.6 の graphify パリティ監査のフォローアップ: grammar ドリフトが静かに埋もれず明示的に失敗するようになり、ignore ファイルの否定ルールがスキャンを遅くしなくなりました。
+
+- **grammar ドリフトは「静かな空グラフ」ではなく明示的な失敗に** — tree-sitter クエリがサポートすべき grammar に対してコンパイルに失敗すると（将来の grammar 更新でのノード型改名など）、`run_query` が例外を送出し、該当ファイルは静かに 0 件抽出される代わりに `ExtractionFailure` として記録されます。0.6.6 の上限ピン + 「すべてのクエリが、サポートを宣言したすべての grammar に対してコンパイルされる」テストと合わせ、ドリフトが 3 つの独立した方法で検出されます。
+- **`.codebeaconignore` の単一の `!` 否定が、もはやツリー全体の走査を強制しない** — どこかにある否定ルール 1 つがディレクトリ枝刈りを*全体的に*無効化していたため、その否定が中で何も復活させられない場合でも、スキャナはすべての除外ディレクトリ（`node_modules`、`build` など）へ降りていました。いまや無視されたディレクトリは、否定が実際に*その下*のファイルを再包含しうる場合にのみ走査され、無関係な `!` ルールはコストになりません。
+- **ignore glob を一度だけコンパイル** — gitignore 形式のマッチャは、パス検査ごとに正規表現を再構築する代わりに、パターンごとにコンパイル済み正規表現をメモ化します（大きな ignore ファイルを持つ深いツリーでの探索が高速化）。意味は不変です。
+
+---
+
+## 0.6.6 の新機能
+
+アップストリーム v0.8.37–v0.8.40（および #1362 までの報告 issue）の graphify パリティ監査: 32 候補を「検証してから敵対的に反証する」方式で精査し、**実バグ 6 件**を確定しました。要点 — フレームワーク抽出器 3 つが静かに*何も*生成していませんでした。
+
+- **TypeScript の Express/Koa/Fastify アプリがルートを抽出するように** — `express.scm` が JavaScript のクラス名ノード型をハードコードしており、これは TypeScript grammar では「Impossible pattern」となるため、クエリ全体がコンパイルに失敗し、そのエラーが握りつぶされていました: **TS の Express アプリはルート 0 件**。（JavaScript アプリは正常で、テストフィクスチャが `.js` のみだったため見過ごされていました。）同じ原因が `vue.scm` にもありました（素の `<script>` の Vue SFC → コンポーネント 0 件）。両者とも JS・TS の双方でコンパイルされる grammar 中立なノードワイルドカードに修正しました。
+- **Spring プロジェクトの Kotlin ファイルがエラーを出さないように** — `spring_boot.scm` は Java grammar のクエリですが Kotlin に対して実行が許可されており、`Invalid node type: marker_annotation` を出してすべての `.kt` ファイルを捨てていました。いまや Kotlin はきれいに除外されます（Kotlin Spring Boot には専用クエリが必要）。
+- **tree-sitter grammar に上限ピンを追加** — `pyproject.toml` が grammar を上限なし（`>=0.23`）でピンしていたため、AST ノード型を改名する将来の grammar リリースがクエリを静かに再び壊しうる状態でした。いまやすべての grammar に互換範囲の上限があり、出荷されるすべての `.scm` が、サポートを宣言したすべての grammar に対してコンパイルされることを検証する新しいテストを追加しました。
+- **抽出キャッシュをバージョン管理** — codebeacon のアップグレード後、変更のないファイルに対して増分 `--update` が*旧*バージョンの抽出結果を再利用しうる状態でした（コンテンツハッシュは抽出器自体の変更を検出できません）。キャッシュには codebeacon バージョンが刻印され、不一致時に破棄されます。
+- **アクセント付き / 非 ASCII 名が macOS で解決される** — `codebeacon query` / `path` / MCP と `affected` がラベルとパスを Unicode NFC 正規化するようになり、macOS のファイル名からコピーした名前（NFD で保存）がグラフ内の NFC ラベルに一致します（例: `Auditoría`）。
+- さらに: 破損した `cache.json` を静かにリセットして上書きする代わりに、バックアップして再構築します。
+
+---
+
 ## 0.6.5 の新機能
 
 `codebeacon upgrade` がどの環境でも動作するようになりました — 従来は通常の pip インストールを前提としており、そうでないマシンでは何もせずに静かに失敗していました。

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.ko.md

@@ -27,6 +27,29 @@
 
 ---
 
+## 0.6.7 새 소식
+
+0.6.6 graphify-패리티 감사의 후속 작업: grammar 드리프트가 이제 조용히 묻히지 않고 명시적으로 실패하며, ignore 파일의 부정 규칙이 더 이상 스캔을 느리게 하지 않습니다.
+
+- **Grammar 드리프트가 "조용한 빈 그래프"가 아니라 명시적 실패로** — tree-sitter 쿼리가 지원해야 할 grammar에 대해 컴파일에 실패하면(향후 grammar 버전업의 노드 타입 개명 등), `run_query`가 이제 예외를 던져 해당 파일이 조용히 0개 추출되는 대신 `ExtractionFailure`로 기록됩니다. 0.6.6의 상한 핀 + "모든 쿼리가 자신이 지원한다고 선언한 모든 grammar에 대해 컴파일된다" 테스트와 함께, 드리프트가 세 가지 독립적인 방법으로 잡힙니다.
+- **`.codebeaconignore`의 단일 `!` 부정 규칙이 더 이상 전체 트리 순회를 강제하지 않음** — 부정 규칙 하나가 어디에 있든 디렉터리 가지치기를 *전역적으로* 비활성화해서, 그 부정 규칙이 안에서 아무것도 되살릴 수 없는 경우에도 스캐너가 모든 제외 디렉터리(`node_modules`, `build` 등)로 내려갔습니다. 이제 각 무시된 디렉터리는 부정 규칙이 실제로 *그 아래* 파일을 되살릴 수 있을 때만 순회되며, 무관한 `!` 규칙은 비용이 들지 않습니다.
+- **Ignore 글롭을 한 번만 컴파일** — gitignore 스타일 매처가 경로를 검사할 때마다 정규식을 다시 만드는 대신 패턴별 컴파일된 정규식을 메모이즈합니다(큰 ignore 파일을 가진 깊은 트리에서 탐색 속도 향상). 동작 의미는 동일합니다.
+
+---
+
+## 0.6.6 새 소식
+
+업스트림 v0.8.37–v0.8.40(및 #1362까지 리포트된 이슈)에 대한 graphify-패리티 감사: 32개 후보를 "검증 후 적대적 반박" 방식으로 훑어 **실제 버그 6개**를 확정했습니다. 핵심 — 프레임워크 추출기 3개가 조용히 *아무것도* 만들지 못하고 있었습니다.
+
+- **TypeScript Express / Koa / Fastify 앱이 이제 라우트를 추출** — `express.scm`이 JavaScript의 클래스 이름 노드 타입을 하드코딩했는데, 이는 TypeScript grammar에서 "Impossible pattern"이라 쿼리 전체가 컴파일에 실패하고 그 에러가 묻혔습니다: **TS Express 앱은 라우트 0개**. (JavaScript 앱은 정상이었고 테스트 픽스처가 `.js`뿐이라 발각되지 않았습니다.) 동일한 근본 원인이 `vue.scm`에도 있었습니다(JS `<script>` Vue SFC → 컴포넌트 0개). 둘 다 JS·TS 모두에서 컴파일되는 grammar 중립 노드 와일드카드로 수정했습니다.
+- **Spring 프로젝트의 Kotlin 파일이 더 이상 에러를 내지 않음** — `spring_boot.scm`은 Java grammar 쿼리인데 Kotlin에 대해 실행이 허용되어 `Invalid node type: marker_annotation`를 내며 모든 `.kt` 파일을 버렸습니다. 이제 Kotlin은 깨끗하게 차단됩니다(Kotlin Spring Boot는 별도 쿼리가 필요).
+- **tree-sitter grammar에 상한 핀 추가** — `pyproject.toml`이 grammar를 상한 없이(`>=0.23`) 핀해서, AST 노드 타입을 개명하는 향후 grammar 릴리스가 쿼리를 조용히 다시 깨뜨릴 수 있었습니다. 이제 모든 grammar에 호환 범위 상한이 있고, 모든 출고 `.scm`이 자신이 지원한다고 선언한 모든 grammar에 대해 컴파일되는지 검증하는 테스트가 추가되었습니다.
+- **추출 캐시에 버전 도장** — codebeacon 업그레이드 후 증분 `--update`가 변경되지 않은 파일에 대해 *이전* 버전이 추출한 결과를 재사용할 수 있었습니다(콘텐츠 해시는 추출기 자체가 바뀐 것을 감지하지 못함). 이제 캐시에 codebeacon 버전이 찍히고 버전 불일치 시 폐기됩니다.
+- **악센트 / 비-ASCII 이름이 macOS에서 해석됨** — `codebeacon query` / `path` / MCP와 `affected`가 라벨과 경로를 Unicode NFC로 정규화하므로, macOS 파일명에서 복사한 이름(NFD로 저장)이 그래프의 NFC 라벨과 매칭됩니다(예: `Auditoría`).
+- 추가로: 손상된 추출 `cache.json`을 조용히 리셋한 뒤 덮어쓰는 대신 백업하고 재생성합니다.
+
+---
+
 ## 0.6.5 새 소식
 
 `codebeacon upgrade` 가 이제 어떤 환경에서도 동작합니다 — 이전에는 일반 pip 설치를 가정해서, 그렇지 않은 머신에서는 아무것도 못 하고 조용히 실패했습니다.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.md

@@ -25,6 +25,29 @@
 
 ---
 
+## What's new in 0.6.7
+
+Follow-ups to the 0.6.6 graphify-parity audit: grammar drift now fails loudly instead of silently, and ignore-file negations no longer slow scans down.
+
+- **Grammar drift is a loud failure, not a silent empty graph** — when a tree-sitter query can't compile against a grammar it's *supposed* to support (e.g. a node-type rename in a future grammar bump), `run_query` now raises and the file is recorded as an `ExtractionFailure` instead of silently extracting nothing. Together with the 0.6.6 upper-bound pins and the "every query compiles against every grammar it claims" test, drift is now caught three independent ways.
+- **A single `!` negation in `.codebeaconignore` no longer forces a full-tree walk** — one negation rule anywhere used to disable directory pruning *everywhere*, so the scanner descended into every excluded directory (`node_modules`, `build`, …) even when the negation couldn't possibly rescue anything there. Each ignored directory is now kept only if a negation could actually re-include a file beneath *it*; unrelated `!` rules cost nothing.
+- **Ignore globs compile once** — the gitignore-style matcher memoizes each pattern's compiled regex instead of rebuilding it on every path check, speeding up discovery on deep trees with large ignore files. (Semantics unchanged.)
+
+---
+
+## What's new in 0.6.6
+
+A graphify-parity audit of upstream v0.8.37–v0.8.40 (and reported issues through #1362): a verify-then-adversarially-refute sweep of 32 candidates confirmed **6 real bugs**. The headline — three framework extractors were silently producing *nothing*.
+
+- **TypeScript Express / Koa / Fastify apps now extract routes** — `express.scm` hard-coded the JavaScript class-name node type, which is an "Impossible pattern" under the TypeScript grammar, so the whole query failed to compile and the error was swallowed: **TS Express apps extracted 0 routes**. (JavaScript apps worked, and the only test fixture was `.js`, so it went unnoticed.) The identical root cause hit `vue.scm` (Vue SFCs with a plain `<script>` → 0 components). Both now use a grammar-neutral node wildcard that compiles under JS and TS.
+- **Kotlin files in Spring projects no longer error** — `spring_boot.scm` is a Java-grammar query but was allowed to run against Kotlin, emitting `Invalid node type: marker_annotation` and dropping every `.kt` file. Kotlin is now gated off cleanly (Kotlin Spring Boot would need its own query).
+- **Tree-sitter grammars are pinned with upper bounds** — `pyproject.toml` pinned grammars open-ended (`>=0.23`), so a future grammar release that renames AST node types could silently re-break the queries. Every grammar now has a compatible-range ceiling, and a new test asserts every shipped `.scm` compiles against every grammar it claims to support.
+- **The extraction cache is versioned** — after upgrading codebeacon, an incremental `--update` could reuse results extracted by the *old* version for unchanged files (a content hash can't detect that the extractor itself changed). The cache is now stamped with the codebeacon version and discarded on mismatch.
+- **Accented / non-ASCII names resolve on macOS** — `codebeacon query` / `path` / MCP and `affected` now Unicode-NFC-normalise labels and paths, so a name copied from a macOS filename (stored as NFD) matches the NFC label in the graph (e.g. `Auditoría`).
+- Plus: a corrupt extraction `cache.json` is backed up and rebuilt instead of being silently reset and then overwritten.
+
+---
+
 ## What's new in 0.6.5
 
 `codebeacon upgrade` now works everywhere — it previously assumed a plain pip install and died silently on machines where that wasn't true.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.pt-BR.md

@@ -27,6 +27,29 @@
 
 ---
 
+## Novidades na 0.6.7
+
+Acompanhamento da auditoria de paridade com graphify da 0.6.6: a deriva de gramática agora falha de forma ruidosa em vez de silenciosa, e as negações no arquivo de ignore não deixam mais os scans lentos.
+
+- **A deriva de gramática é uma falha ruidosa, não um grafo vazio silencioso** — quando uma query do tree-sitter não compila contra uma gramática que *deveria* suportar (p. ex. um nó renomeado em uma futura atualização de gramática), `run_query` agora lança uma exceção e o arquivo é registrado como `ExtractionFailure` em vez de extrair silenciosamente nada. Junto com os limites superiores da 0.6.6 e o teste "cada query compila contra cada gramática que declara suportar", a deriva agora é detectada de três formas independentes.
+- **Uma única negação `!` no `.codebeaconignore` não força mais um percurso completo da árvore** — uma regra de negação em qualquer lugar desativava o pruning de diretórios *em todo lugar*, então o scanner descia em cada diretório excluído (`node_modules`, `build`, …) mesmo quando a negação não podia resgatar nada ali. Agora um diretório ignorado só é mantido se uma negação realmente puder reincluir um arquivo *abaixo dele*; regras `!` não relacionadas não custam nada.
+- **Globs de ignore são compilados uma única vez** — o matcher no estilo gitignore memoiza a regex compilada por padrão em vez de reconstruí-la a cada verificação de caminho (descoberta mais rápida em árvores profundas com arquivos de ignore grandes). Semântica inalterada.
+
+---
+
+## Novidades na 0.6.6
+
+Uma auditoria de paridade com graphify do upstream v0.8.37–v0.8.40 (e issues reportadas até #1362): uma varredura de "verificar e então refutar de forma adversária" sobre 32 candidatos confirmou **6 bugs reais**. O destaque — três extratores de framework produziam silenciosamente *nada*.
+
+- **Apps Express/Koa/Fastify em TypeScript agora extraem rotas** — `express.scm` fixava o nó de nome de classe do JavaScript, que é um "Impossible pattern" sob a gramática do TypeScript, então a query inteira não compilava e o erro era engolido: **apps Express em TS extraíam 0 rotas**. (Apps JavaScript funcionavam, e a única fixture de teste era `.js`, então passou despercebido.) A mesma causa atingia `vue.scm` (SFCs Vue com `<script>` simples → 0 componentes). Ambos agora usam um coringa de nó neutro de gramática que compila em JS e TS.
+- **Arquivos Kotlin em projetos Spring não dão mais erro** — `spring_boot.scm` é uma query de gramática Java mas tinha permissão de rodar contra Kotlin, emitindo `Invalid node type: marker_annotation` e descartando cada arquivo `.kt`. Kotlin agora é bloqueado de forma limpa (Kotlin Spring Boot precisaria de sua própria query).
+- **Gramáticas do tree-sitter têm limites superiores fixados** — `pyproject.toml` fixava as gramáticas sem limite superior (`>=0.23`), então um futuro release de gramática que renomeasse nós da AST poderia quebrar as queries silenciosamente de novo. Cada gramática agora tem um teto de faixa compatível, e um novo teste verifica que cada `.scm` distribuída compila contra cada gramática que declara suportar.
+- **O cache de extração é versionado** — após atualizar o codebeacon, um `--update` incremental podia reutilizar resultados extraídos pela versão *antiga* para arquivos inalterados (um hash de conteúdo não detecta que o extrator mudou). O cache agora carrega a versão do codebeacon e é descartado em caso de divergência.
+- **Nomes acentuados / não ASCII resolvem no macOS** — `codebeacon query` / `path` / MCP e `affected` agora normalizam rótulos e caminhos para Unicode NFC, de modo que um nome copiado de um nome de arquivo do macOS (armazenado como NFD) corresponde ao rótulo NFC no grafo (p. ex. `Auditoría`).
+- Além disso: um `cache.json` corrompido é salvo em backup e reconstruído em vez de ser silenciosamente resetado e sobrescrito.
+
+---
+
 ## Novidades na 0.6.5
 
 `codebeacon upgrade` agora funciona em qualquer ambiente — antes ele presumia uma instalação pip comum e falhava silenciosamente em máquinas onde não era o caso.

{codebeacon-0.6.5 → codebeacon-0.6.7}/README.zh-CN.md

@@ -27,6 +27,29 @@
 
 ---
 
+## 0.6.7 新功能
+
+对 0.6.6 graphify 对齐审计的后续:grammar 漂移现在会明确报错而非静默掩盖,ignore 文件中的否定规则也不再拖慢扫描。
+
+- **grammar 漂移是明确的失败,而非静默的空图** — 当 tree-sitter 查询无法对它*应当*支持的 grammar 编译时(例如未来 grammar 升级中重命名了节点类型),`run_query` 现在会抛出异常,该文件被记录为 `ExtractionFailure`,而不是静默地抽取出 0 项。配合 0.6.6 的上限固定以及"每个查询都能对它声明支持的每个 grammar 编译"的测试,漂移现在通过三种独立方式被发现。
+- **`.codebeaconignore` 中单个 `!` 否定不再强制全树遍历** — 任意位置的一条否定规则会*全局*禁用目录剪枝,导致扫描器即使该否定无法在其中救回任何文件,也会进入每个被排除的目录(`node_modules`、`build` 等)。现在只有当某条否定确实可能重新包含其*下方*的文件时,被忽略的目录才会被遍历;无关的 `!` 规则不再有任何开销。
+- **ignore glob 只编译一次** — gitignore 风格的匹配器会按模式缓存已编译的正则,而不是在每次路径检查时重建(在带有大型 ignore 文件的深层目录树上发现更快)。语义不变。
+
+---
+
+## 0.6.6 新功能
+
+对上游 v0.8.37–v0.8.40(以及截至 #1362 的报告 issue)的 graphify 对齐审计:以"先验证再对抗性反驳"的方式排查 32 个候选,确认了 **6 个真实 bug**。重点 — 三个框架抽取器在静默地*什么都不*产出。
+
+- **TypeScript 的 Express/Koa/Fastify 应用现在能抽取路由** — `express.scm` 硬编码了 JavaScript 的类名节点类型,这在 TypeScript grammar 下是 "Impossible pattern",于是整个查询无法编译且错误被吞掉:**TS 的 Express 应用抽取出 0 条路由**。(JavaScript 应用正常,而唯一的测试夹具是 `.js`,所以一直没被发现。)同样的根因也出现在 `vue.scm`(带普通 `<script>` 的 Vue SFC → 0 个组件)。两者现在都改用在 JS 与 TS 下都能编译的 grammar 中立节点通配符。
+- **Spring 项目中的 Kotlin 文件不再报错** — `spring_boot.scm` 是 Java grammar 查询,却被允许对 Kotlin 运行,抛出 `Invalid node type: marker_annotation` 并丢弃每个 `.kt` 文件。Kotlin 现在被干净地拦截(Kotlin Spring Boot 需要它自己的查询)。
+- **tree-sitter grammar 加上了版本上限** — `pyproject.toml` 此前对 grammar 不设上限地固定(`>=0.23`),因此未来某个重命名 AST 节点类型的 grammar 发布可能再次静默破坏查询。现在每个 grammar 都有一个兼容范围上限,并新增了一个测试,验证每个随附的 `.scm` 都能对它声明支持的每个 grammar 编译。
+- **抽取缓存带上了版本** — 升级 codebeacon 后,增量 `--update` 可能对未改动的文件复用*旧*版本抽取的结果(内容哈希无法察觉抽取器本身变了)。缓存现在带有 codebeacon 版本,版本不匹配时被丢弃。
+- **带重音 / 非 ASCII 的名称在 macOS 上能解析** — `codebeacon query` / `path` / MCP 与 `affected` 现在会把标签和路径做 Unicode NFC 规范化,因此从 macOS 文件名(以 NFD 存储)复制的名称能匹配图中的 NFC 标签(例如 `Auditoría`)。
+- 此外:损坏的 `cache.json` 会被备份并重建,而不是被静默重置后覆盖。
+
+---
+
 ## 0.6.5 新功能
 
 `codebeacon upgrade` 现在在任何环境下都能工作 — 此前它假定是普通 pip 安装，在并非如此的机器上会静默失败、什么也不做。

codebeacon-0.6.7/codebeacon/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.6.7"

{codebeacon-0.6.5 → codebeacon-0.6.7}/codebeacon/affected.py

@@ -17,6 +17,7 @@ Mirrors graphify #e44e6e9 ("v8 affected").
 from __future__ import annotations
 
 import subprocess
+import unicodedata
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Iterable
@@ -94,8 +95,10 @@ def affected_from_paths(
 
     # Normalise seed paths to POSIX with forward slashes; node source_file may
     # be absolute or repo-relative depending on how it was extracted, so we
-    # match by suffix (a relative suffix of the absolute node path).
-    seeds = [str(p).replace("\\", "/") for p in changed_paths]
+    # match by suffix (a relative suffix of the absolute node path). NFC-
+    # normalise so a macOS git-diff path (NFD) with accented filenames still
+    # matches the NFC source_file stored in beacon.json (#1338).
+    seeds = [unicodedata.normalize("NFC", str(p)).replace("\\", "/") for p in changed_paths]
 
     def _suffix_match(a: str, b: str) -> bool:
         # True when one path is a *path-segment-aligned* suffix of the other,
@@ -108,7 +111,7 @@ def affected_from_paths(
 
     seed_node_ids: list[str] = []
     for node_id, data in G.nodes(data=True):
-        src = (data.get("source_file") or "").replace("\\", "/")
+        src = unicodedata.normalize("NFC", data.get("source_file") or "").replace("\\", "/")
         if not src:
             continue
         if any(_suffix_match(src, seed) for seed in seeds):

{codebeacon-0.6.5 → codebeacon-0.6.7}/codebeacon/cache.py

@@ -33,6 +33,7 @@ from __future__ import annotations
 import hashlib
 import json
 import os
+import sys
 import threading
 import time
 from pathlib import Path
@@ -94,15 +95,52 @@ class Cache:
     def load(self) -> None:
         """Load cache from disk. Safe to call even if the cache file doesn't exist.
 
-        When ``project_root`` is set, any legacy absolute-path keys that
-        sit inside the project are rewritten to relative form. The first
-        save afterwards persists the migration.
+        On-disk format is a version-stamped wrapper::
+
+            {"_cb_version": "0.6.6", "entries": {key: entry, ...}}
+
+        A cache written by a *different* codebeacon version is discarded: the
+        extractor logic and the ``.scm`` queries change between releases, so
+        reusing an older version's result for an *unchanged* source file would
+        serve silently-stale output. The content hash can't catch this — the
+        file didn't change, the extractor did. (Mirrors graphify #1252.) A
+        legacy *flat* cache (pre-0.6.6, no wrapper) is unversioned and dropped
+        for the same reason.
+
+        When ``project_root`` is set, surviving absolute-path keys are rewritten
+        to relative form (graphify #777); the first save persists the migration.
         """
+        from codebeacon import __version__
+
+        raw: Any = None
         try:
             if self._cache_file.exists():
-                self._data = json.loads(self._cache_file.read_text(encoding="utf-8"))
+                raw = json.loads(self._cache_file.read_text(encoding="utf-8"))
         except (json.JSONDecodeError, OSError):
+            # Corrupt cache.json — preserve it (don't let the next save silently
+            # overwrite and destroy it) and rebuild from scratch. Mirrors the
+            # graphify v0.8.39 "manifest data-loss on corrupt JSON" fix.
+            self._backup_corrupt()
+            raw = None
+
+        if isinstance(raw, dict) and "_cb_version" in raw and "entries" in raw:
+            stored_version = raw.get("_cb_version")
+            entries = raw.get("entries") or {}
+        elif isinstance(raw, dict):
+            stored_version, entries = None, raw  # legacy flat (unversioned)
+        else:
+            stored_version, entries = __version__, {}  # nothing on disk
+
+        if stored_version != __version__:
+            # Discard a foreign-version / unversioned cache exactly once. Mark
+            # dirty only when there was something to drop, so the fresh,
+            # version-stamped cache is written on save().
             self._data = {}
+            if entries:
+                self._dirty = True
+            return
+
+        self._data = entries if isinstance(entries, dict) else {}
         if self._root is None or not self._data:
             return
         migrated: dict[str, dict] = {}
@@ -116,13 +154,33 @@ class Cache:
             self._data = migrated
             self._dirty = True
 
+    def _backup_corrupt(self) -> None:
+        """Move a corrupt ``cache.json`` aside so the next ``save()`` can't
+        silently overwrite it. Best-effort; the cache is reproducible."""
+        try:
+            ts = time.strftime("%Y%m%d-%H%M%S")
+            backup = self._cache_file.with_name(f"{self._cache_file.name}.{ts}.corrupt")
+            self._cache_file.replace(backup)
+            print(
+                f"codebeacon: {self._cache_file} was corrupt; preserved as "
+                f"{backup.name} and rebuilt the cache.",
+                file=sys.stderr,
+            )
+        except OSError:
+            pass
+
     def save(self) -> None:
         """Persist cache to disk. No-op if nothing has changed."""
         if not self._dirty:
             return
+        from codebeacon import __version__
+
         self._cache_dir.mkdir(parents=True, exist_ok=True)
         self._cache_file.write_text(
-            json.dumps(self._data, ensure_ascii=False, indent=2),
+            json.dumps(
+                {"_cb_version": __version__, "entries": self._data},
+                ensure_ascii=False, indent=2,
+            ),
             encoding="utf-8",
         )
         self._dirty = False