codebeacon 0.6.5__tar.gz → 0.6.8__tar.gz

codebeacon-0.6.5/README.md → codebeacon-0.6.8/PKG-INFO

@@ -1,3 +1,96 @@
+Metadata-Version: 2.4
+Name: codebeacon
+Version: 0.6.8
+Summary: Source code AST analysis tool for AI context generation — unified multi-framework knowledge graph
+Project-URL: Homepage, https://github.com/codebeacon/codebeacon
+Project-URL: Repository, https://github.com/codebeacon/codebeacon
+Project-URL: Issues, https://github.com/codebeacon/codebeacon/issues
+License: MIT
+License-File: LICENSE
+Keywords: ai-context,ast,claude,codebase,knowledge-graph,mcp
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: networkx>=3.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: tree-sitter-javascript<0.26,>=0.23
+Requires-Dist: tree-sitter-python<0.26,>=0.23
+Requires-Dist: tree-sitter-typescript<0.24,>=0.23
+Requires-Dist: tree-sitter<0.26,>=0.23
+Provides-Extra: backend
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'backend'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'backend'
+Provides-Extra: cluster
+Requires-Dist: graspologic>=1.0; extra == 'cluster'
+Provides-Extra: csharp
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'csharp'
+Provides-Extra: dev
+Requires-Dist: pytest-cov>=4.0; extra == 'dev'
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'dev'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'dev'
+Provides-Extra: dotnet
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'dotnet'
+Provides-Extra: full
+Requires-Dist: tree-sitter-c-sharp<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'full'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'full'
+Provides-Extra: go
+Requires-Dist: tree-sitter-go<0.26,>=0.23; extra == 'go'
+Provides-Extra: html
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'html'
+Provides-Extra: java
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'java'
+Provides-Extra: jvm
+Requires-Dist: tree-sitter-java<0.24,>=0.23; extra == 'jvm'
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'jvm'
+Provides-Extra: kotlin
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'kotlin'
+Provides-Extra: mobile
+Requires-Dist: tree-sitter-kotlin<1.2,>=0.23; extra == 'mobile'
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'mobile'
+Provides-Extra: php
+Requires-Dist: tree-sitter-php<0.25,>=0.23; extra == 'php'
+Provides-Extra: ruby
+Requires-Dist: tree-sitter-ruby<0.24,>=0.23; extra == 'ruby'
+Provides-Extra: rust
+Requires-Dist: tree-sitter-rust<0.25,>=0.23; extra == 'rust'
+Provides-Extra: svelte
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'svelte'
+Provides-Extra: swift
+Requires-Dist: tree-sitter-swift<0.8,>=0.0.1; extra == 'swift'
+Provides-Extra: web
+Requires-Dist: tree-sitter-html<0.24,>=0.23; extra == 'web'
+Requires-Dist: tree-sitter-svelte<1.1,>=0.23; extra == 'web'
+Description-Content-Type: text/markdown
+
 <p align="center">
   <a href="https://github.com/Wandererer/codebeacon/blob/main/README.md"><img src="https://img.shields.io/badge/lang-English-blue" alt="English"></a>
   <a href="https://github.com/Wandererer/codebeacon/blob/main/README.ko.md"><img src="https://img.shields.io/badge/lang-한국어-red" alt="Korean"></a>
@@ -25,6 +118,43 @@
 
 ---
 
+## What's new in 0.6.8
+
+A graphify-parity audit of upstream v0.8.41–v0.9.3 (reported issues through #1568). Every candidate was reproduced against codebeacon before fixing and re-checked by an adversarial review pass; **7 real bugs** confirmed, headlined by a data-loss trap and a privacy leak.
+
+- **`--obsidian-dir` can no longer delete your notes** — pointed at an existing Obsidian vault, the export swept *every* `.md` under it before regenerating, so it could wipe a real vault. codebeacon now refuses any directory it doesn't own (only a genuinely empty dir, or one carrying its `.codebeacon-vault.json` marker, is adopted) and skips the export with a clear message instead of deleting.
+- **`.gitignore` is no longer silently disabled by `.codebeaconignore`** — adding a `.codebeaconignore` used to *replace* the repo's `.gitignore`, so a file excluded only by `.gitignore` (a neutrally-named `prod-dump.sql`, `customer-data.*`) would get indexed into the committed `.codebeacon/` artifacts. The two are now merged (`.codebeaconignore` wins on conflict); adding it can only ever exclude *more*.
+- **No machine-absolute paths in committed artifacts** — edge/link `source_file` values (the bulk of `beacon.json`) and the `Source:` lines in wiki/obsidian notes kept absolute `/Users/you/...` paths, so the committed index wasn't portable and leaked local paths. All are now project-relative (edges included, and cross-project `shares_db_entity` files too).
+- **Same-named symbols in different directories no longer overwrite each other's notes** — wiki/obsidian filenames were derived from the label with no case-folding, so on macOS/Windows `UserService` and `userService` collided and one note was silently lost. Filenames are now collision-salted and case-folded; punctuation-only labels (`@`) fall back to `unnamed` instead of a broken `@.md`.
+- **A corrupt `beacon.json` no longer crashes** — `codebeacon affected`, the MCP server, and `--wiki-only` runs now back up a corrupt/truncated graph and report a clear "re-run scan" message instead of a raw traceback.
+- **More React components are captured** — `react.scm` missed function-expression components (`const X = function() {…}`), bare-imported HOCs (`const X = forwardRef(…)` without the `React.` prefix), and non-exported `function X()` components. All three are now extracted.
+- **Wiki links never dangle** — a link to a page that was never written is downgraded to plain text, and a link to an article in a sibling bucket (a service → its entity) is repaired to the correct relative path instead of pointing at a missing file.
+
+---
+
+## What's new in 0.6.7
+
+Follow-ups to the 0.6.6 graphify-parity audit: grammar drift now fails loudly instead of silently, and ignore-file negations no longer slow scans down.
+
+- **Grammar drift is a loud failure, not a silent empty graph** — when a tree-sitter query can't compile against a grammar it's *supposed* to support (e.g. a node-type rename in a future grammar bump), `run_query` now raises and the file is recorded as an `ExtractionFailure` instead of silently extracting nothing. Together with the 0.6.6 upper-bound pins and the "every query compiles against every grammar it claims" test, drift is now caught three independent ways.
+- **A single `!` negation in `.codebeaconignore` no longer forces a full-tree walk** — one negation rule anywhere used to disable directory pruning *everywhere*, so the scanner descended into every excluded directory (`node_modules`, `build`, …) even when the negation couldn't possibly rescue anything there. Each ignored directory is now kept only if a negation could actually re-include a file beneath *it*; unrelated `!` rules cost nothing.
+- **Ignore globs compile once** — the gitignore-style matcher memoizes each pattern's compiled regex instead of rebuilding it on every path check, speeding up discovery on deep trees with large ignore files. (Semantics unchanged.)
+
+---
+
+## What's new in 0.6.6
+
+A graphify-parity audit of upstream v0.8.37–v0.8.40 (and reported issues through #1362): a verify-then-adversarially-refute sweep of 32 candidates confirmed **6 real bugs**. The headline — three framework extractors were silently producing *nothing*.
+
+- **TypeScript Express / Koa / Fastify apps now extract routes** — `express.scm` hard-coded the JavaScript class-name node type, which is an "Impossible pattern" under the TypeScript grammar, so the whole query failed to compile and the error was swallowed: **TS Express apps extracted 0 routes**. (JavaScript apps worked, and the only test fixture was `.js`, so it went unnoticed.) The identical root cause hit `vue.scm` (Vue SFCs with a plain `<script>` → 0 components). Both now use a grammar-neutral node wildcard that compiles under JS and TS.
+- **Kotlin files in Spring projects no longer error** — `spring_boot.scm` is a Java-grammar query but was allowed to run against Kotlin, emitting `Invalid node type: marker_annotation` and dropping every `.kt` file. Kotlin is now gated off cleanly (Kotlin Spring Boot would need its own query).
+- **Tree-sitter grammars are pinned with upper bounds** — `pyproject.toml` pinned grammars open-ended (`>=0.23`), so a future grammar release that renames AST node types could silently re-break the queries. Every grammar now has a compatible-range ceiling, and a new test asserts every shipped `.scm` compiles against every grammar it claims to support.
+- **The extraction cache is versioned** — after upgrading codebeacon, an incremental `--update` could reuse results extracted by the *old* version for unchanged files (a content hash can't detect that the extractor itself changed). The cache is now stamped with the codebeacon version and discarded on mismatch.
+- **Accented / non-ASCII names resolve on macOS** — `codebeacon query` / `path` / MCP and `affected` now Unicode-NFC-normalise labels and paths, so a name copied from a macOS filename (stored as NFD) matches the NFC label in the graph (e.g. `Auditoría`).
+- Plus: a corrupt extraction `cache.json` is backed up and rebuilt instead of being silently reset and then overwritten.
+
+---
+
 ## What's new in 0.6.5
 
 `codebeacon upgrade` now works everywhere — it previously assumed a plain pip install and died silently on machines where that wasn't true.

{codebeacon-0.6.5 → codebeacon-0.6.8}/README.de.md

@@ -27,6 +27,43 @@
 
 ---
 
+## Neu in 0.6.8
+
+Ein graphify-Parity-Audit von Upstream v0.8.41–v0.9.3 (gemeldete Issues bis #1568). Jeder Kandidat wurde vor der Behebung gegen codebeacon reproduziert und durch eine adversariale Review-Runde erneut geprüft; **7 echte Bugs** bestätigt, angeführt von einer Datenverlust-Falle und einem Privacy-Leak.
+
+- **`--obsidian-dir` kann keine Notizen mehr löschen** — bei einem bestehenden Obsidian-Vault fegte der Export vor der Neugenerierung *jede* `.md` darunter weg und konnte so ein echtes Vault leeren. codebeacon verweigert jetzt jedes Verzeichnis, das es nicht besitzt (nur ein wirklich leeres Verzeichnis oder eines mit seinem `.codebeacon-vault.json`-Marker wird übernommen) und überspringt den Export mit einer klaren Meldung statt zu löschen.
+- **`.gitignore` wird nicht mehr still durch `.codebeaconignore` deaktiviert** — das Hinzufügen einer `.codebeaconignore` *ersetzte* bisher die `.gitignore` des Repos, sodass eine nur durch `.gitignore` ausgeschlossene Datei (ein neutral benanntes `prod-dump.sql`, `customer-data.*`) in die committeten `.codebeacon/`-Artefakte indexiert werden konnte. Beide werden jetzt zusammengeführt (`.codebeaconignore` gewinnt bei Konflikten); das Hinzufügen kann nur *mehr* ausschließen.
+- **Keine maschinenabsoluten Pfade mehr in committeten Artefakten** — `source_file`-Werte an Edges/Links (der Großteil von `beacon.json`) und die `Source:`-Zeilen in Wiki-/Obsidian-Notizen behielten absolute `/Users/du/...`-Pfade, sodass der committete Index nicht portabel war und lokale Pfade preisgab. Alle sind jetzt projekt-relativ (inklusive Edges und projektübergreifender `shares_db_entity`-Dateien).
+- **Gleichnamige Symbole in unterschiedlichen Verzeichnissen überschreiben sich nicht mehr** — Wiki-/Obsidian-Dateinamen wurden ohne Groß-/Kleinschreibungs-Faltung aus dem Label abgeleitet, sodass unter macOS/Windows `UserService` und `userService` kollidierten und eine Notiz still verloren ging. Dateinamen sind jetzt kollisions-gesalzen und case-gefaltet; Labels aus reiner Interpunktion (`@`) fallen auf `unnamed` zurück statt auf ein kaputtes `@.md`.
+- **Ein beschädigtes `beacon.json` stürzt nicht mehr ab** — `codebeacon affected`, der MCP-Server und `--wiki-only`-Läufe sichern jetzt einen beschädigten/abgeschnittenen Graphen und melden eine klare „Scan erneut ausführen"-Meldung statt eines rohen Tracebacks.
+- **Mehr React-Komponenten werden erfasst** — `react.scm` übersah Function-Expression-Komponenten (`const X = function() {…}`), bare-importierte HOCs (`const X = forwardRef(…)` ohne `React.`-Präfix) und nicht exportierte `function X()`-Komponenten. Alle drei werden jetzt extrahiert.
+- **Wiki-Links laufen nie ins Leere** — ein Link auf eine nie geschriebene Seite wird zu reinem Text herabgestuft, und ein Link auf einen Artikel in einem Nachbar-Bucket (ein Service → seine Entity) wird auf den korrekten relativen Pfad repariert, statt auf eine fehlende Datei zu zeigen.
+
+---
+
+## Neu in 0.6.7
+
+Folgearbeiten zum graphify-Parity-Audit aus 0.6.6: Grammar-Drift schlägt jetzt laut fehl statt stillschweigend, und Negationen in der Ignore-Datei verlangsamen Scans nicht mehr.
+
+- **Grammar-Drift ist ein lauter Fehler, kein stiller leerer Graph** — wenn eine tree-sitter-Query gegen eine Grammar, die sie unterstützen *soll*, nicht kompiliert (z. B. eine umbenannte Node-Art in einem künftigen Grammar-Update), wirft `run_query` jetzt eine Ausnahme und die Datei wird als `ExtractionFailure` erfasst, statt still nichts zu extrahieren. Zusammen mit den Obergrenzen-Pins aus 0.6.6 und dem Test „jede Query kompiliert gegen jede Grammar, die sie beansprucht" wird Drift nun auf drei unabhängige Weisen erkannt.
+- **Eine einzelne `!`-Negation in `.codebeaconignore` erzwingt keinen vollständigen Baum-Durchlauf mehr** — eine Negationsregel irgendwo hat das Verzeichnis-Pruning *überall* deaktiviert, sodass der Scanner in jedes ausgeschlossene Verzeichnis (`node_modules`, `build`, …) hinabstieg, selbst wenn die Negation dort nichts retten konnte. Ein ignoriertes Verzeichnis wird jetzt nur behalten, wenn eine Negation tatsächlich eine Datei *darunter* wieder einschließen könnte; nicht zugehörige `!`-Regeln kosten nichts.
+- **Ignore-Globs werden einmal kompiliert** — der gitignore-artige Matcher merkt sich die kompilierte Regex je Muster, statt sie bei jeder Pfadprüfung neu zu bauen (schnellere Erkennung bei tiefen Bäumen mit großen Ignore-Dateien). Semantik unverändert.
+
+---
+
+## Neu in 0.6.6
+
+Ein graphify-Parity-Audit von Upstream v0.8.37–v0.8.40 (und gemeldeten Issues bis #1362): ein „prüfen, dann adversarial widerlegen"-Durchlauf über 32 Kandidaten bestätigte **6 echte Bugs**. Der Hauptpunkt — drei Framework-Extraktoren produzierten still *nichts*.
+
+- **TypeScript-Express/Koa/Fastify-Apps extrahieren jetzt Routen** — `express.scm` hatte die JavaScript-Node-Art für Klassennamen fest verdrahtet, was unter der TypeScript-Grammar ein „Impossible pattern" ist; die gesamte Query kompilierte nicht und der Fehler wurde verschluckt: **TS-Express-Apps extrahierten 0 Routen**. (JavaScript-Apps funktionierten, und die einzige Test-Fixture war `.js`, daher blieb es unbemerkt.) Dieselbe Ursache traf `vue.scm` (Vue-SFCs mit reinem `<script>` → 0 Komponenten). Beide nutzen jetzt einen grammar-neutralen Node-Wildcard, der unter JS und TS kompiliert.
+- **Kotlin-Dateien in Spring-Projekten verursachen keinen Fehler mehr** — `spring_boot.scm` ist eine Java-Grammar-Query, durfte aber gegen Kotlin laufen und gab `Invalid node type: marker_annotation` aus, wobei jede `.kt`-Datei verworfen wurde. Kotlin wird jetzt sauber ausgeschlossen (Kotlin-Spring-Boot bräuchte eine eigene Query).
+- **tree-sitter-Grammars haben jetzt Versions-Obergrenzen** — `pyproject.toml` pinnte Grammars nach oben offen (`>=0.23`), sodass ein künftiges Grammar-Release, das AST-Node-Arten umbenennt, die Queries still wieder hätte brechen können. Jede Grammar hat nun eine kompatible Obergrenze, und ein neuer Test prüft, dass jede ausgelieferte `.scm` gegen jede beanspruchte Grammar kompiliert.
+- **Der Extraktions-Cache ist versioniert** — nach einem Upgrade konnte ein inkrementelles `--update` für unveränderte Dateien Ergebnisse der *alten* Version wiederverwenden (ein Content-Hash erkennt nicht, dass sich der Extraktor geändert hat). Der Cache trägt jetzt die codebeacon-Version und wird bei Abweichung verworfen.
+- **Akzentuierte / Nicht-ASCII-Namen werden unter macOS aufgelöst** — `codebeacon query` / `path` / MCP und `affected` normalisieren Labels und Pfade jetzt nach Unicode-NFC, sodass ein aus einem macOS-Dateinamen (als NFD gespeichert) kopierter Name das NFC-Label im Graphen trifft (z. B. `Auditoría`).
+- Außerdem: eine beschädigte `cache.json` wird gesichert und neu aufgebaut, statt still zurückgesetzt und überschrieben zu werden.
+
+---
+
 ## Neu in 0.6.5
 
 `codebeacon upgrade` funktioniert jetzt überall — bisher ging der Befehl von einer normalen pip-Installation aus und scheiterte auf anderen Maschinen stillschweigend.

{codebeacon-0.6.5 → codebeacon-0.6.8}/README.es.md

@@ -27,6 +27,43 @@
 
 ---
 
+## Novedades en 0.6.8
+
+Una auditoría de paridad con graphify del upstream v0.8.41–v0.9.3 (issues reportados hasta el #1568). Cada candidato se reprodujo contra codebeacon antes de corregirlo y se volvió a comprobar con una ronda de revisión adversarial; se confirmaron **7 bugs reales**, encabezados por una trampa de pérdida de datos y una fuga de privacidad.
+
+- **`--obsidian-dir` ya no puede borrar tus notas** — apuntando a un vault de Obsidian existente, la exportación barría *todos* los `.md` debajo antes de regenerar, pudiendo vaciar un vault real. codebeacon ahora rechaza cualquier directorio que no posea (solo se adopta un directorio genuinamente vacío, o uno que lleve su marcador `.codebeacon-vault.json`) y omite la exportación con un mensaje claro en vez de borrar.
+- **`.gitignore` ya no queda deshabilitado en silencio por `.codebeaconignore`** — añadir un `.codebeaconignore` solía *reemplazar* el `.gitignore` del repo, así que un archivo excluido solo por `.gitignore` (un `prod-dump.sql`, `customer-data.*` de nombre neutro) podía terminar indexado en los artefactos `.codebeacon/` que se commitean. Ahora ambos se fusionan (`.codebeaconignore` gana en conflicto); añadirlo solo puede excluir *más*.
+- **Sin rutas absolutas de máquina en los artefactos commiteados** — los valores `source_file` de edges/links (el grueso de `beacon.json`) y las líneas `Source:` en las notas de wiki/obsidian conservaban rutas absolutas `/Users/tu/...`, así que el índice commiteado no era portable y filtraba rutas locales. Ahora todas son relativas al proyecto (edges incluidos, y también los archivos `shares_db_entity` entre proyectos).
+- **Símbolos con el mismo nombre en directorios distintos ya no se sobrescriben las notas** — los nombres de archivo de wiki/obsidian se derivaban de la etiqueta sin normalizar mayúsculas/minúsculas, así que en macOS/Windows `UserService` y `userService` colisionaban y una nota se perdía en silencio. Ahora los nombres de archivo llevan sal anti-colisión y normalización de mayúsculas; las etiquetas solo de puntuación (`@`) recurren a `unnamed` en vez de un `@.md` roto.
+- **Un `beacon.json` corrupto ya no provoca un cuelgue** — `codebeacon affected`, el servidor MCP y las ejecuciones `--wiki-only` ahora respaldan un grafo corrupto/truncado y muestran un mensaje claro de "vuelve a ejecutar scan" en vez de un traceback en crudo.
+- **Se capturan más componentes de React** — `react.scm` pasaba por alto los componentes de expresión de función (`const X = function() {…}`), los HOC importados sin calificar (`const X = forwardRef(…)` sin el prefijo `React.`) y los componentes `function X()` no exportados. Los tres se extraen ahora.
+- **Los enlaces del wiki nunca quedan rotos** — un enlace a una página que nunca se escribió se degrada a texto plano, y un enlace a un artículo en un bucket hermano (un servicio → su entidad) se repara a la ruta relativa correcta en vez de apuntar a un archivo inexistente.
+
+---
+
+## Novedades en 0.6.7
+
+Seguimiento de la auditoría de paridad con graphify de 0.6.6: la deriva de gramática ahora falla de forma ruidosa en lugar de silenciosa, y las negaciones en el archivo de ignore ya no ralentizan los escaneos.
+
+- **La deriva de gramática es un fallo ruidoso, no un grafo vacío silencioso** — cuando una query de tree-sitter no compila contra una gramática que *debería* soportar (p. ej. un nodo renombrado en una futura actualización de gramática), `run_query` ahora lanza una excepción y el archivo se registra como `ExtractionFailure` en lugar de extraer silenciosamente nada. Junto con los topes superiores de 0.6.6 y el test «cada query compila contra cada gramática que declara soportar», la deriva se detecta ahora de tres formas independientes.
+- **Una sola negación `!` en `.codebeaconignore` ya no fuerza un recorrido completo del árbol** — una regla de negación en cualquier sitio desactivaba el pruning de directorios *en todas partes*, así que el escáner descendía a cada directorio excluido (`node_modules`, `build`, …) aunque la negación no pudiera rescatar nada allí. Ahora un directorio ignorado solo se conserva si una negación realmente podría reincluir un archivo *debajo de él*; las reglas `!` no relacionadas no cuestan nada.
+- **Los globs de ignore se compilan una sola vez** — el matcher estilo gitignore memoiza la regex compilada por patrón en lugar de reconstruirla en cada comprobación de ruta (descubrimiento más rápido en árboles profundos con archivos de ignore grandes). La semántica no cambia.
+
+---
+
+## Novedades en 0.6.6
+
+Una auditoría de paridad con graphify de upstream v0.8.37–v0.8.40 (e issues reportados hasta #1362): un barrido de «verificar y luego refutar de forma adversaria» sobre 32 candidatos confirmó **6 bugs reales**. Lo principal: tres extractores de framework producían silenciosamente *nada*.
+
+- **Las apps de Express/Koa/Fastify en TypeScript ahora extraen rutas** — `express.scm` fijaba el nodo de nombre de clase de JavaScript, que es un «Impossible pattern» bajo la gramática de TypeScript, así que toda la query no compilaba y el error se tragaba: **las apps de Express en TS extraían 0 rutas**. (Las apps de JavaScript funcionaban, y la única fixture de test era `.js`, así que pasó desapercibido.) La misma causa afectaba a `vue.scm` (SFC de Vue con `<script>` plano → 0 componentes). Ambos usan ahora un comodín de nodo neutral a la gramática que compila en JS y TS.
+- **Los archivos Kotlin en proyectos Spring ya no dan error** — `spring_boot.scm` es una query de gramática Java pero se permitía ejecutarla contra Kotlin, emitiendo `Invalid node type: marker_annotation` y descartando cada archivo `.kt`. Kotlin ahora se bloquea limpiamente (Kotlin Spring Boot necesitaría su propia query).
+- **Las gramáticas de tree-sitter están fijadas con topes superiores** — `pyproject.toml` fijaba las gramáticas sin límite superior (`>=0.23`), así que un futuro release de gramática que renombrara nodos del AST podría romper las queries de nuevo en silencio. Cada gramática tiene ahora un tope de rango compatible, y un nuevo test verifica que cada `.scm` distribuida compila contra cada gramática que declara soportar.
+- **La caché de extracción está versionada** — tras actualizar codebeacon, un `--update` incremental podía reutilizar resultados extraídos por la versión *antigua* para archivos sin cambios (un hash de contenido no detecta que el extractor cambió). La caché ahora lleva la versión de codebeacon y se descarta si no coincide.
+- **Los nombres acentuados / no ASCII se resuelven en macOS** — `codebeacon query` / `path` / MCP y `affected` ahora normalizan etiquetas y rutas a Unicode NFC, de modo que un nombre copiado de un nombre de archivo de macOS (guardado como NFD) coincide con la etiqueta NFC del grafo (p. ej. `Auditoría`).
+- Además: una `cache.json` corrupta se respalda y se reconstruye en lugar de resetearse y sobrescribirse en silencio.
+
+---
+
 ## Novedades en 0.6.5
 
 `codebeacon upgrade` ahora funciona en cualquier entorno — antes asumía una instalación pip normal y fallaba silenciosamente en máquinas donde no lo era.

{codebeacon-0.6.5 → codebeacon-0.6.8}/README.fr.md

@@ -27,6 +27,43 @@
 
 ---
 
+## Nouveautés en 0.6.8
+
+Un audit de parité graphify de l'upstream v0.8.41–v0.9.3 (issues signalées jusqu'au #1568). Chaque candidat a été reproduit sur codebeacon avant correction, puis revérifié par une passe de revue adversariale ; **7 bugs réels** confirmés, avec en tête un piège à perte de données et une fuite de confidentialité.
+
+- **`--obsidian-dir` ne peut plus supprimer vos notes** — pointé vers un vault Obsidian existant, l'export balayait *tous* les `.md` en dessous avant de régénérer, pouvant ainsi vider un vrai vault. codebeacon refuse désormais tout répertoire qu'il ne possède pas (seul un répertoire réellement vide, ou portant son marqueur `.codebeacon-vault.json`, est adopté) et saute l'export avec un message clair au lieu de supprimer.
+- **`.gitignore` n'est plus désactivé silencieusement par `.codebeaconignore`** — ajouter un `.codebeaconignore` *remplaçait* auparavant le `.gitignore` du dépôt, si bien qu'un fichier exclu uniquement par `.gitignore` (un `prod-dump.sql`, `customer-data.*` au nom neutre) pouvait être indexé dans les artefacts `.codebeacon/` commités. Les deux sont désormais fusionnés (`.codebeaconignore` l'emporte en cas de conflit) ; l'ajouter ne peut que exclure *davantage*.
+- **Plus aucun chemin absolu machine dans les artefacts commités** — les valeurs `source_file` des edges/links (l'essentiel de `beacon.json`) et les lignes `Source:` des notes wiki/obsidian conservaient des chemins absolus `/Users/vous/...`, rendant l'index commité non portable et divulguant des chemins locaux. Tout est désormais relatif au projet (edges compris, ainsi que les fichiers `shares_db_entity` inter-projets).
+- **Des symboles homonymes dans des répertoires différents n'écrasent plus les notes l'un de l'autre** — les noms de fichiers wiki/obsidian étaient dérivés du label sans normalisation de casse, si bien que sur macOS/Windows `UserService` et `userService` entraient en collision et une note disparaissait silencieusement. Les noms de fichiers sont désormais salés anti-collision et normalisés en casse ; les labels tout en ponctuation (`@`) retombent sur `unnamed` au lieu d'un `@.md` cassé.
+- **Un `beacon.json` corrompu ne plante plus** — `codebeacon affected`, le serveur MCP et les exécutions `--wiki-only` sauvegardent désormais un graphe corrompu/tronqué et affichent un message clair « relancez scan » au lieu d'une trace brute.
+- **Davantage de composants React sont capturés** — `react.scm` manquait les composants en expression de fonction (`const X = function() {…}`), les HOC importés nus (`const X = forwardRef(…)` sans préfixe `React.`) et les composants `function X()` non exportés. Les trois sont désormais extraits.
+- **Les liens du wiki ne pointent plus jamais dans le vide** — un lien vers une page jamais écrite est rétrogradé en texte brut, et un lien vers un article dans un bucket voisin (un service → son entité) est réparé vers le bon chemin relatif au lieu de pointer vers un fichier manquant.
+
+---
+
+## Nouveautés en 0.6.7
+
+Suite de l'audit de parité graphify de 0.6.6 : la dérive de grammaire échoue désormais bruyamment au lieu de silencieusement, et les négations du fichier d'ignore ne ralentissent plus les scans.
+
+- **La dérive de grammaire est un échec bruyant, pas un graphe vide silencieux** — quand une requête tree-sitter ne compile pas contre une grammaire qu'elle est *censée* prendre en charge (p. ex. un nœud renommé dans une future mise à jour de grammaire), `run_query` lève désormais une exception et le fichier est enregistré comme `ExtractionFailure` au lieu de n'extraire silencieusement rien. Avec les bornes supérieures de 0.6.6 et le test « chaque requête compile contre chaque grammaire qu'elle revendique », la dérive est désormais détectée de trois façons indépendantes.
+- **Une seule négation `!` dans `.codebeaconignore` ne force plus un parcours complet de l'arbre** — une règle de négation où que ce soit désactivait l'élagage des répertoires *partout*, de sorte que le scanner descendait dans chaque répertoire exclu (`node_modules`, `build`, …) même si la négation ne pouvait rien y récupérer. Un répertoire ignoré n'est désormais conservé que si une négation pourrait réellement réinclure un fichier *en dessous* ; les règles `!` non liées ne coûtent rien.
+- **Les globs d'ignore sont compilés une seule fois** — le matcher de style gitignore mémorise la regex compilée par motif au lieu de la reconstruire à chaque vérification de chemin (découverte plus rapide sur les arbres profonds avec de gros fichiers d'ignore). Sémantique inchangée.
+
+---
+
+## Nouveautés en 0.6.6
+
+Un audit de parité graphify de l'upstream v0.8.37–v0.8.40 (et des issues signalées jusqu'à #1362) : un balayage « vérifier puis réfuter de façon adverse » sur 32 candidats a confirmé **6 vrais bugs**. L'essentiel — trois extracteurs de framework ne produisaient silencieusement *rien*.
+
+- **Les apps Express/Koa/Fastify en TypeScript extraient désormais des routes** — `express.scm` codait en dur le nœud de nom de classe de JavaScript, qui est un « Impossible pattern » sous la grammaire TypeScript ; toute la requête ne compilait pas et l'erreur était avalée : **les apps Express en TS extrayaient 0 route**. (Les apps JavaScript fonctionnaient, et la seule fixture de test était `.js`, donc c'est passé inaperçu.) La même cause touchait `vue.scm` (SFC Vue avec `<script>` simple → 0 composant). Les deux utilisent désormais un joker de nœud neutre vis-à-vis de la grammaire qui compile en JS et TS.
+- **Les fichiers Kotlin dans les projets Spring ne provoquent plus d'erreur** — `spring_boot.scm` est une requête de grammaire Java mais était autorisée à s'exécuter contre Kotlin, émettant `Invalid node type: marker_annotation` et écartant chaque fichier `.kt`. Kotlin est désormais proprement bloqué (Kotlin Spring Boot nécessiterait sa propre requête).
+- **Les grammaires tree-sitter sont épinglées avec des bornes supérieures** — `pyproject.toml` épinglait les grammaires sans limite supérieure (`>=0.23`), de sorte qu'une future version de grammaire renommant des nœuds de l'AST pouvait à nouveau casser les requêtes en silence. Chaque grammaire a désormais un plafond de plage compatible, et un nouveau test vérifie que chaque `.scm` livrée compile contre chaque grammaire qu'elle revendique.
+- **Le cache d'extraction est versionné** — après une mise à jour de codebeacon, un `--update` incrémental pouvait réutiliser des résultats extraits par l'*ancienne* version pour des fichiers inchangés (un hash de contenu ne détecte pas que l'extracteur a changé). Le cache porte désormais la version de codebeacon et est rejeté en cas de divergence.
+- **Les noms accentués / non-ASCII se résolvent sous macOS** — `codebeacon query` / `path` / MCP et `affected` normalisent désormais les libellés et chemins en Unicode NFC, de sorte qu'un nom copié depuis un nom de fichier macOS (stocké en NFD) correspond au libellé NFC dans le graphe (p. ex. `Auditoría`).
+- De plus : un `cache.json` corrompu est sauvegardé et reconstruit au lieu d'être silencieusement réinitialisé puis écrasé.
+
+---
+
 ## Nouveautés en 0.6.5
 
 `codebeacon upgrade` fonctionne désormais partout — il supposait auparavant une installation pip classique et échouait silencieusement sur les machines où ce n'était pas le cas.

{codebeacon-0.6.5 → codebeacon-0.6.8}/README.ja.md

@@ -27,6 +27,43 @@
 
 ---
 
+## 0.6.8 の新機能
+
+アップストリーム v0.8.41–v0.9.3(報告された issue は #1568 まで)の graphify パリティ監査です。各候補は修正前に codebeacon 上で実際に再現し、敵対的レビューパスで再確認しました。**実バグ7件**を確認、データ損失トラップとプライバシー漏洩が目玉です。
+
+- **`--obsidian-dir` がノートを削除しなくなりました** — 既存の Obsidian vault を指定すると、再生成前にその配下の*すべて*の `.md` を一掃していたため、実際の vault を空にしてしまう可能性がありました。codebeacon は所有していないディレクトリを拒否するようになり(完全に空のディレクトリ、または `.codebeacon-vault.json` マーカーを持つディレクトリのみ採用)、削除する代わりに明確なメッセージとともにエクスポートをスキップします。
+- **`.codebeaconignore` によって `.gitignore` が静かに無効化されなくなりました** — `.codebeaconignore` を追加すると以前はリポジトリの `.gitignore` を*置き換えて*いたため、`.gitignore` だけで除外されているファイル(中立的な名前の `prod-dump.sql`、`customer-data.*`)がコミットされる `.codebeacon/` 成果物にインデックスされる可能性がありました。両者は今やマージされます(競合時は `.codebeaconignore` が優先);追加しても除外が*増える*だけになりました。
+- **コミットされる成果物にマシン絶対パスが含まれなくなりました** — エッジ/リンクの `source_file` 値(`beacon.json` の大半)と wiki/obsidian ノートの `Source:` 行が絶対パス `/Users/you/...` を保持していたため、コミットされたインデックスに可搬性がなく、ローカルパスが漏洩していました。すべてプロジェクト相対になりました(エッジ、およびプロジェクト横断の `shares_db_entity` ファイルも含む)。
+- **異なるディレクトリの同名シンボルがノートを上書きしなくなりました** — wiki/obsidian のファイル名は大文字小文字を畳み込まずにラベルから生成されていたため、macOS/Windows で `UserService` と `userService` が衝突し、片方のノートが静かに失われていました。ファイル名は衝突耐性のソルトと大文字小文字の畳み込みを行うようになり、記号のみのラベル(`@`)は壊れた `@.md` の代わりに `unnamed` にフォールバックします。
+- **破損した `beacon.json` でクラッシュしなくなりました** — `codebeacon affected`、MCP サーバー、`--wiki-only` 実行は、破損/切り詰められたグラフをバックアップし、生のトレースバックの代わりに明確な「scan を再実行してください」メッセージを報告するようになりました。
+- **より多くの React コンポーネントを捕捉するようになりました** — `react.scm` は関数式コンポーネント(`const X = function() {…}`)、`React.` プレフィックスなしの bare import HOC(`const X = forwardRef(…)`)、および非エクスポートの `function X()` コンポーネントを見落としていました。この3つすべてが抽出されるようになりました。
+- **wiki のリンクがリンク切れにならなくなりました** — 一度も書き込まれなかったページへのリンクはプレーンテキストに格下げされ、隣接バケット内の記事(サービス→そのエンティティ)へのリンクは、存在しないファイルを指す代わりに正しい相対パスに修復されます。
+
+---
+
+## 0.6.7 の新機能
+
+0.6.6 の graphify パリティ監査のフォローアップ: grammar ドリフトが静かに埋もれず明示的に失敗するようになり、ignore ファイルの否定ルールがスキャンを遅くしなくなりました。
+
+- **grammar ドリフトは「静かな空グラフ」ではなく明示的な失敗に** — tree-sitter クエリがサポートすべき grammar に対してコンパイルに失敗すると（将来の grammar 更新でのノード型改名など）、`run_query` が例外を送出し、該当ファイルは静かに 0 件抽出される代わりに `ExtractionFailure` として記録されます。0.6.6 の上限ピン + 「すべてのクエリが、サポートを宣言したすべての grammar に対してコンパイルされる」テストと合わせ、ドリフトが 3 つの独立した方法で検出されます。
+- **`.codebeaconignore` の単一の `!` 否定が、もはやツリー全体の走査を強制しない** — どこかにある否定ルール 1 つがディレクトリ枝刈りを*全体的に*無効化していたため、その否定が中で何も復活させられない場合でも、スキャナはすべての除外ディレクトリ（`node_modules`、`build` など）へ降りていました。いまや無視されたディレクトリは、否定が実際に*その下*のファイルを再包含しうる場合にのみ走査され、無関係な `!` ルールはコストになりません。
+- **ignore glob を一度だけコンパイル** — gitignore 形式のマッチャは、パス検査ごとに正規表現を再構築する代わりに、パターンごとにコンパイル済み正規表現をメモ化します（大きな ignore ファイルを持つ深いツリーでの探索が高速化）。意味は不変です。
+
+---
+
+## 0.6.6 の新機能
+
+アップストリーム v0.8.37–v0.8.40（および #1362 までの報告 issue）の graphify パリティ監査: 32 候補を「検証してから敵対的に反証する」方式で精査し、**実バグ 6 件**を確定しました。要点 — フレームワーク抽出器 3 つが静かに*何も*生成していませんでした。
+
+- **TypeScript の Express/Koa/Fastify アプリがルートを抽出するように** — `express.scm` が JavaScript のクラス名ノード型をハードコードしており、これは TypeScript grammar では「Impossible pattern」となるため、クエリ全体がコンパイルに失敗し、そのエラーが握りつぶされていました: **TS の Express アプリはルート 0 件**。（JavaScript アプリは正常で、テストフィクスチャが `.js` のみだったため見過ごされていました。）同じ原因が `vue.scm` にもありました（素の `<script>` の Vue SFC → コンポーネント 0 件）。両者とも JS・TS の双方でコンパイルされる grammar 中立なノードワイルドカードに修正しました。
+- **Spring プロジェクトの Kotlin ファイルがエラーを出さないように** — `spring_boot.scm` は Java grammar のクエリですが Kotlin に対して実行が許可されており、`Invalid node type: marker_annotation` を出してすべての `.kt` ファイルを捨てていました。いまや Kotlin はきれいに除外されます（Kotlin Spring Boot には専用クエリが必要）。
+- **tree-sitter grammar に上限ピンを追加** — `pyproject.toml` が grammar を上限なし（`>=0.23`）でピンしていたため、AST ノード型を改名する将来の grammar リリースがクエリを静かに再び壊しうる状態でした。いまやすべての grammar に互換範囲の上限があり、出荷されるすべての `.scm` が、サポートを宣言したすべての grammar に対してコンパイルされることを検証する新しいテストを追加しました。
+- **抽出キャッシュをバージョン管理** — codebeacon のアップグレード後、変更のないファイルに対して増分 `--update` が*旧*バージョンの抽出結果を再利用しうる状態でした（コンテンツハッシュは抽出器自体の変更を検出できません）。キャッシュには codebeacon バージョンが刻印され、不一致時に破棄されます。
+- **アクセント付き / 非 ASCII 名が macOS で解決される** — `codebeacon query` / `path` / MCP と `affected` がラベルとパスを Unicode NFC 正規化するようになり、macOS のファイル名からコピーした名前（NFD で保存）がグラフ内の NFC ラベルに一致します（例: `Auditoría`）。
+- さらに: 破損した `cache.json` を静かにリセットして上書きする代わりに、バックアップして再構築します。
+
+---
+
 ## 0.6.5 の新機能
 
 `codebeacon upgrade` がどの環境でも動作するようになりました — 従来は通常の pip インストールを前提としており、そうでないマシンでは何もせずに静かに失敗していました。

{codebeacon-0.6.5 → codebeacon-0.6.8}/README.ko.md

@@ -27,6 +27,43 @@
 
 ---
 
+## 0.6.8 새 소식
+
+업스트림 v0.8.41–v0.9.3(보고된 이슈 #1568까지)에 대한 graphify-패리티 감사입니다. 모든 후보를 수정 전에 codebeacon에서 실제로 재현하고 적대적 리뷰 패스로 재검증했으며, **7개의 실제 버그**를 확인했습니다 — 데이터 손실 함정과 프라이버시 유출이 핵심입니다.
+
+- **`--obsidian-dir`가 더 이상 사용자 노트를 삭제하지 않음** — 기존 Obsidian 볼트를 가리키면 재생성 전에 그 아래 *모든* `.md`를 지워서 실제 볼트를 통째로 날릴 수 있었습니다. 이제 codebeacon이 소유하지 않은 디렉터리는 거부하고(완전히 비어 있거나 `.codebeacon-vault.json` 마커를 가진 디렉터리만 채택), 삭제 대신 명확한 메시지와 함께 내보내기를 건너뜁니다.
+- **`.codebeaconignore`가 `.gitignore`를 조용히 무력화하지 않음** — `.codebeaconignore`를 추가하면 저장소의 `.gitignore`를 *대체*해서, `.gitignore`로만 제외된 파일(중립적 이름의 `prod-dump.sql`, `customer-data.*`)이 커밋되는 `.codebeacon/` 산출물에 인덱싱될 수 있었습니다. 이제 둘을 병합하며(충돌 시 `.codebeaconignore` 우선), 추가해도 *더 많이* 제외할 수만 있습니다.
+- **커밋되는 산출물에 머신 절대 경로 없음** — 엣지/링크의 `source_file`(`beacon.json`의 대부분)과 wiki/obsidian 노트의 `Source:` 줄이 절대 경로 `/Users/you/...`를 유지해서 인덱스가 이식성이 없고 로컬 경로가 유출됐습니다. 이제 모두 프로젝트 상대 경로입니다(엣지 포함, 교차 프로젝트 `shares_db_entity` 파일도).
+- **다른 디렉터리의 동일 이름 심볼이 서로의 노트를 덮어쓰지 않음** — wiki/obsidian 파일명이 대소문자 구분 없이 라벨에서 생성돼, macOS/Windows에서 `UserService`와 `userService`가 충돌해 한쪽 노트가 조용히 사라졌습니다. 이제 파일명이 충돌-솔팅 + 대소문자 폴딩되며, 구두점만 있는 라벨(`@`)은 깨진 `@.md` 대신 `unnamed`로 대체됩니다.
+- **손상된 `beacon.json`이 더 이상 크래시를 내지 않음** — `codebeacon affected`, MCP 서버, `--wiki-only` 실행이 이제 손상/절단된 그래프를 백업하고 원시 트레이스백 대신 명확한 "scan 재실행" 메시지를 보여줍니다.
+- **더 많은 React 컴포넌트 캡처** — `react.scm`이 함수식 컴포넌트(`const X = function() {…}`), bare-import HOC(`React.` 접두 없는 `const X = forwardRef(…)`), 비-export `function X()` 컴포넌트를 놓쳤습니다. 이제 셋 다 추출됩니다.
+- **wiki 링크가 깨지지 않음** — 작성되지 않은 페이지로의 링크는 일반 텍스트로 강등되고, 형제 버킷의 문서로 가는 링크(서비스 → 엔티티)는 없는 파일을 가리키는 대신 올바른 상대 경로로 복구됩니다.
+
+---
+
+## 0.6.7 새 소식
+
+0.6.6 graphify-패리티 감사의 후속 작업: grammar 드리프트가 이제 조용히 묻히지 않고 명시적으로 실패하며, ignore 파일의 부정 규칙이 더 이상 스캔을 느리게 하지 않습니다.
+
+- **Grammar 드리프트가 "조용한 빈 그래프"가 아니라 명시적 실패로** — tree-sitter 쿼리가 지원해야 할 grammar에 대해 컴파일에 실패하면(향후 grammar 버전업의 노드 타입 개명 등), `run_query`가 이제 예외를 던져 해당 파일이 조용히 0개 추출되는 대신 `ExtractionFailure`로 기록됩니다. 0.6.6의 상한 핀 + "모든 쿼리가 자신이 지원한다고 선언한 모든 grammar에 대해 컴파일된다" 테스트와 함께, 드리프트가 세 가지 독립적인 방법으로 잡힙니다.
+- **`.codebeaconignore`의 단일 `!` 부정 규칙이 더 이상 전체 트리 순회를 강제하지 않음** — 부정 규칙 하나가 어디에 있든 디렉터리 가지치기를 *전역적으로* 비활성화해서, 그 부정 규칙이 안에서 아무것도 되살릴 수 없는 경우에도 스캐너가 모든 제외 디렉터리(`node_modules`, `build` 등)로 내려갔습니다. 이제 각 무시된 디렉터리는 부정 규칙이 실제로 *그 아래* 파일을 되살릴 수 있을 때만 순회되며, 무관한 `!` 규칙은 비용이 들지 않습니다.
+- **Ignore 글롭을 한 번만 컴파일** — gitignore 스타일 매처가 경로를 검사할 때마다 정규식을 다시 만드는 대신 패턴별 컴파일된 정규식을 메모이즈합니다(큰 ignore 파일을 가진 깊은 트리에서 탐색 속도 향상). 동작 의미는 동일합니다.
+
+---
+
+## 0.6.6 새 소식
+
+업스트림 v0.8.37–v0.8.40(및 #1362까지 리포트된 이슈)에 대한 graphify-패리티 감사: 32개 후보를 "검증 후 적대적 반박" 방식으로 훑어 **실제 버그 6개**를 확정했습니다. 핵심 — 프레임워크 추출기 3개가 조용히 *아무것도* 만들지 못하고 있었습니다.
+
+- **TypeScript Express / Koa / Fastify 앱이 이제 라우트를 추출** — `express.scm`이 JavaScript의 클래스 이름 노드 타입을 하드코딩했는데, 이는 TypeScript grammar에서 "Impossible pattern"이라 쿼리 전체가 컴파일에 실패하고 그 에러가 묻혔습니다: **TS Express 앱은 라우트 0개**. (JavaScript 앱은 정상이었고 테스트 픽스처가 `.js`뿐이라 발각되지 않았습니다.) 동일한 근본 원인이 `vue.scm`에도 있었습니다(JS `<script>` Vue SFC → 컴포넌트 0개). 둘 다 JS·TS 모두에서 컴파일되는 grammar 중립 노드 와일드카드로 수정했습니다.
+- **Spring 프로젝트의 Kotlin 파일이 더 이상 에러를 내지 않음** — `spring_boot.scm`은 Java grammar 쿼리인데 Kotlin에 대해 실행이 허용되어 `Invalid node type: marker_annotation`를 내며 모든 `.kt` 파일을 버렸습니다. 이제 Kotlin은 깨끗하게 차단됩니다(Kotlin Spring Boot는 별도 쿼리가 필요).
+- **tree-sitter grammar에 상한 핀 추가** — `pyproject.toml`이 grammar를 상한 없이(`>=0.23`) 핀해서, AST 노드 타입을 개명하는 향후 grammar 릴리스가 쿼리를 조용히 다시 깨뜨릴 수 있었습니다. 이제 모든 grammar에 호환 범위 상한이 있고, 모든 출고 `.scm`이 자신이 지원한다고 선언한 모든 grammar에 대해 컴파일되는지 검증하는 테스트가 추가되었습니다.
+- **추출 캐시에 버전 도장** — codebeacon 업그레이드 후 증분 `--update`가 변경되지 않은 파일에 대해 *이전* 버전이 추출한 결과를 재사용할 수 있었습니다(콘텐츠 해시는 추출기 자체가 바뀐 것을 감지하지 못함). 이제 캐시에 codebeacon 버전이 찍히고 버전 불일치 시 폐기됩니다.
+- **악센트 / 비-ASCII 이름이 macOS에서 해석됨** — `codebeacon query` / `path` / MCP와 `affected`가 라벨과 경로를 Unicode NFC로 정규화하므로, macOS 파일명에서 복사한 이름(NFD로 저장)이 그래프의 NFC 라벨과 매칭됩니다(예: `Auditoría`).
+- 추가로: 손상된 추출 `cache.json`을 조용히 리셋한 뒤 덮어쓰는 대신 백업하고 재생성합니다.
+
+---
+
 ## 0.6.5 새 소식
 
 `codebeacon upgrade` 가 이제 어떤 환경에서도 동작합니다 — 이전에는 일반 pip 설치를 가정해서, 그렇지 않은 머신에서는 아무것도 못 하고 조용히 실패했습니다.

codebeacon-0.6.5/PKG-INFO → codebeacon-0.6.8/README.md

@@ -1,96 +1,3 @@
-Metadata-Version: 2.4
-Name: codebeacon
-Version: 0.6.5
-Summary: Source code AST analysis tool for AI context generation — unified multi-framework knowledge graph
-Project-URL: Homepage, https://github.com/codebeacon/codebeacon
-Project-URL: Repository, https://github.com/codebeacon/codebeacon
-Project-URL: Issues, https://github.com/codebeacon/codebeacon/issues
-License: MIT
-License-File: LICENSE
-Keywords: ai-context,ast,claude,codebase,knowledge-graph,mcp
-Classifier: Development Status :: 3 - Alpha
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Topic :: Software Development :: Build Tools
-Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.10
-Requires-Dist: networkx>=3.0
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: tree-sitter-javascript>=0.23
-Requires-Dist: tree-sitter-python>=0.23
-Requires-Dist: tree-sitter-typescript>=0.23
-Requires-Dist: tree-sitter>=0.23
-Provides-Extra: backend
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-go>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-java>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-php>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'backend'
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'backend'
-Provides-Extra: cluster
-Requires-Dist: graspologic>=1.0; extra == 'cluster'
-Provides-Extra: csharp
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'csharp'
-Provides-Extra: dev
-Requires-Dist: pytest-cov>=4.0; extra == 'dev'
-Requires-Dist: pytest>=7.0; extra == 'dev'
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-go>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-html>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-java>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-php>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'dev'
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'dev'
-Provides-Extra: dotnet
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'dotnet'
-Provides-Extra: full
-Requires-Dist: tree-sitter-c-sharp>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-go>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-html>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-java>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-php>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'full'
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'full'
-Provides-Extra: go
-Requires-Dist: tree-sitter-go>=0.23; extra == 'go'
-Provides-Extra: html
-Requires-Dist: tree-sitter-html>=0.23; extra == 'html'
-Provides-Extra: java
-Requires-Dist: tree-sitter-java>=0.23; extra == 'java'
-Provides-Extra: jvm
-Requires-Dist: tree-sitter-java>=0.23; extra == 'jvm'
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'jvm'
-Provides-Extra: kotlin
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'kotlin'
-Provides-Extra: mobile
-Requires-Dist: tree-sitter-kotlin>=0.23; extra == 'mobile'
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'mobile'
-Provides-Extra: php
-Requires-Dist: tree-sitter-php>=0.23; extra == 'php'
-Provides-Extra: ruby
-Requires-Dist: tree-sitter-ruby>=0.23; extra == 'ruby'
-Provides-Extra: rust
-Requires-Dist: tree-sitter-rust>=0.23; extra == 'rust'
-Provides-Extra: svelte
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'svelte'
-Provides-Extra: swift
-Requires-Dist: tree-sitter-swift>=0.0.1; extra == 'swift'
-Provides-Extra: web
-Requires-Dist: tree-sitter-html>=0.23; extra == 'web'
-Requires-Dist: tree-sitter-svelte>=0.23; extra == 'web'
-Description-Content-Type: text/markdown
-
 <p align="center">
   <a href="https://github.com/Wandererer/codebeacon/blob/main/README.md"><img src="https://img.shields.io/badge/lang-English-blue" alt="English"></a>
   <a href="https://github.com/Wandererer/codebeacon/blob/main/README.ko.md"><img src="https://img.shields.io/badge/lang-한국어-red" alt="Korean"></a>
@@ -118,6 +25,43 @@ Description-Content-Type: text/markdown
 
 ---
 
+## What's new in 0.6.8
+
+A graphify-parity audit of upstream v0.8.41–v0.9.3 (reported issues through #1568). Every candidate was reproduced against codebeacon before fixing and re-checked by an adversarial review pass; **7 real bugs** confirmed, headlined by a data-loss trap and a privacy leak.
+
+- **`--obsidian-dir` can no longer delete your notes** — pointed at an existing Obsidian vault, the export swept *every* `.md` under it before regenerating, so it could wipe a real vault. codebeacon now refuses any directory it doesn't own (only a genuinely empty dir, or one carrying its `.codebeacon-vault.json` marker, is adopted) and skips the export with a clear message instead of deleting.
+- **`.gitignore` is no longer silently disabled by `.codebeaconignore`** — adding a `.codebeaconignore` used to *replace* the repo's `.gitignore`, so a file excluded only by `.gitignore` (a neutrally-named `prod-dump.sql`, `customer-data.*`) would get indexed into the committed `.codebeacon/` artifacts. The two are now merged (`.codebeaconignore` wins on conflict); adding it can only ever exclude *more*.
+- **No machine-absolute paths in committed artifacts** — edge/link `source_file` values (the bulk of `beacon.json`) and the `Source:` lines in wiki/obsidian notes kept absolute `/Users/you/...` paths, so the committed index wasn't portable and leaked local paths. All are now project-relative (edges included, and cross-project `shares_db_entity` files too).
+- **Same-named symbols in different directories no longer overwrite each other's notes** — wiki/obsidian filenames were derived from the label with no case-folding, so on macOS/Windows `UserService` and `userService` collided and one note was silently lost. Filenames are now collision-salted and case-folded; punctuation-only labels (`@`) fall back to `unnamed` instead of a broken `@.md`.
+- **A corrupt `beacon.json` no longer crashes** — `codebeacon affected`, the MCP server, and `--wiki-only` runs now back up a corrupt/truncated graph and report a clear "re-run scan" message instead of a raw traceback.
+- **More React components are captured** — `react.scm` missed function-expression components (`const X = function() {…}`), bare-imported HOCs (`const X = forwardRef(…)` without the `React.` prefix), and non-exported `function X()` components. All three are now extracted.
+- **Wiki links never dangle** — a link to a page that was never written is downgraded to plain text, and a link to an article in a sibling bucket (a service → its entity) is repaired to the correct relative path instead of pointing at a missing file.
+
+---
+
+## What's new in 0.6.7
+
+Follow-ups to the 0.6.6 graphify-parity audit: grammar drift now fails loudly instead of silently, and ignore-file negations no longer slow scans down.
+
+- **Grammar drift is a loud failure, not a silent empty graph** — when a tree-sitter query can't compile against a grammar it's *supposed* to support (e.g. a node-type rename in a future grammar bump), `run_query` now raises and the file is recorded as an `ExtractionFailure` instead of silently extracting nothing. Together with the 0.6.6 upper-bound pins and the "every query compiles against every grammar it claims" test, drift is now caught three independent ways.
+- **A single `!` negation in `.codebeaconignore` no longer forces a full-tree walk** — one negation rule anywhere used to disable directory pruning *everywhere*, so the scanner descended into every excluded directory (`node_modules`, `build`, …) even when the negation couldn't possibly rescue anything there. Each ignored directory is now kept only if a negation could actually re-include a file beneath *it*; unrelated `!` rules cost nothing.
+- **Ignore globs compile once** — the gitignore-style matcher memoizes each pattern's compiled regex instead of rebuilding it on every path check, speeding up discovery on deep trees with large ignore files. (Semantics unchanged.)
+
+---
+
+## What's new in 0.6.6
+
+A graphify-parity audit of upstream v0.8.37–v0.8.40 (and reported issues through #1362): a verify-then-adversarially-refute sweep of 32 candidates confirmed **6 real bugs**. The headline — three framework extractors were silently producing *nothing*.
+
+- **TypeScript Express / Koa / Fastify apps now extract routes** — `express.scm` hard-coded the JavaScript class-name node type, which is an "Impossible pattern" under the TypeScript grammar, so the whole query failed to compile and the error was swallowed: **TS Express apps extracted 0 routes**. (JavaScript apps worked, and the only test fixture was `.js`, so it went unnoticed.) The identical root cause hit `vue.scm` (Vue SFCs with a plain `<script>` → 0 components). Both now use a grammar-neutral node wildcard that compiles under JS and TS.
+- **Kotlin files in Spring projects no longer error** — `spring_boot.scm` is a Java-grammar query but was allowed to run against Kotlin, emitting `Invalid node type: marker_annotation` and dropping every `.kt` file. Kotlin is now gated off cleanly (Kotlin Spring Boot would need its own query).
+- **Tree-sitter grammars are pinned with upper bounds** — `pyproject.toml` pinned grammars open-ended (`>=0.23`), so a future grammar release that renames AST node types could silently re-break the queries. Every grammar now has a compatible-range ceiling, and a new test asserts every shipped `.scm` compiles against every grammar it claims to support.
+- **The extraction cache is versioned** — after upgrading codebeacon, an incremental `--update` could reuse results extracted by the *old* version for unchanged files (a content hash can't detect that the extractor itself changed). The cache is now stamped with the codebeacon version and discarded on mismatch.
+- **Accented / non-ASCII names resolve on macOS** — `codebeacon query` / `path` / MCP and `affected` now Unicode-NFC-normalise labels and paths, so a name copied from a macOS filename (stored as NFD) matches the NFC label in the graph (e.g. `Auditoría`).
+- Plus: a corrupt extraction `cache.json` is backed up and rebuilt instead of being silently reset and then overwritten.
+
+---
+
 ## What's new in 0.6.5
 
 `codebeacon upgrade` now works everywhere — it previously assumed a plain pip install and died silently on machines where that wasn't true.

{codebeacon-0.6.5 → codebeacon-0.6.8}/README.pt-BR.md

@@ -27,6 +27,43 @@
 
 ---
 
+## Novidades na 0.6.8
+
+Uma auditoria de paridade com graphify do upstream v0.8.41–v0.9.3 (issues reportadas até a #1568). Cada candidato foi reproduzido contra o codebeacon antes de ser corrigido e reverificado por uma rodada de revisão adversarial; **7 bugs reais** confirmados, com destaque para uma armadilha de perda de dados e um vazamento de privacidade.
+
+- **`--obsidian-dir` não consegue mais apagar suas notas** — apontado para um vault do Obsidian existente, a exportação varria *todo* `.md` abaixo dele antes de regenerar, podendo esvaziar um vault real. O codebeacon agora recusa qualquer diretório que não possua (só um diretório genuinamente vazio, ou um com o marcador `.codebeacon-vault.json`, é adotado) e pula a exportação com uma mensagem clara em vez de apagar.
+- **`.gitignore` não é mais desativado silenciosamente pelo `.codebeaconignore`** — adicionar um `.codebeaconignore` costumava *substituir* o `.gitignore` do repositório, então um arquivo excluído só pelo `.gitignore` (um `prod-dump.sql`, `customer-data.*` de nome neutro) podia acabar indexado nos artefatos `.codebeacon/` commitados. Agora os dois são mesclados (`.codebeaconignore` vence em conflito); adicioná-lo só pode excluir *mais*.
+- **Nenhum caminho absoluto de máquina nos artefatos commitados** — os valores `source_file` de edges/links (a maior parte do `beacon.json`) e as linhas `Source:` nas notas de wiki/obsidian mantinham caminhos absolutos `/Users/voce/...`, então o índice commitado não era portátil e vazava caminhos locais. Agora todos são relativos ao projeto (edges incluídos, e também os arquivos `shares_db_entity` entre projetos).
+- **Símbolos com o mesmo nome em diretórios diferentes não sobrescrevem mais as notas um do outro** — os nomes de arquivo de wiki/obsidian eram derivados do label sem normalização de maiúsculas/minúsculas, então no macOS/Windows `UserService` e `userService` colidiam e uma nota era silenciosamente perdida. Os nomes de arquivo agora recebem sal anticolisão e normalização de caixa; labels só com pontuação (`@`) caem para `unnamed` em vez de um `@.md` quebrado.
+- **Um `beacon.json` corrompido não trava mais** — `codebeacon affected`, o servidor MCP e execuções `--wiki-only` agora fazem backup de um grafo corrompido/truncado e mostram uma mensagem clara de "execute o scan novamente" em vez de um traceback bruto.
+- **Mais componentes React são capturados** — `react.scm` deixava passar componentes de expressão de função (`const X = function() {…}`), HOCs importados sem qualificação (`const X = forwardRef(…)` sem o prefixo `React.`) e componentes `function X()` não exportados. Os três agora são extraídos.
+- **Links do wiki nunca ficam quebrados** — um link para uma página que nunca foi escrita é rebaixado a texto simples, e um link para um artigo em um bucket irmão (um serviço → sua entidade) é reparado para o caminho relativo correto em vez de apontar para um arquivo inexistente.
+
+---
+
+## Novidades na 0.6.7
+
+Acompanhamento da auditoria de paridade com graphify da 0.6.6: a deriva de gramática agora falha de forma ruidosa em vez de silenciosa, e as negações no arquivo de ignore não deixam mais os scans lentos.
+
+- **A deriva de gramática é uma falha ruidosa, não um grafo vazio silencioso** — quando uma query do tree-sitter não compila contra uma gramática que *deveria* suportar (p. ex. um nó renomeado em uma futura atualização de gramática), `run_query` agora lança uma exceção e o arquivo é registrado como `ExtractionFailure` em vez de extrair silenciosamente nada. Junto com os limites superiores da 0.6.6 e o teste "cada query compila contra cada gramática que declara suportar", a deriva agora é detectada de três formas independentes.
+- **Uma única negação `!` no `.codebeaconignore` não força mais um percurso completo da árvore** — uma regra de negação em qualquer lugar desativava o pruning de diretórios *em todo lugar*, então o scanner descia em cada diretório excluído (`node_modules`, `build`, …) mesmo quando a negação não podia resgatar nada ali. Agora um diretório ignorado só é mantido se uma negação realmente puder reincluir um arquivo *abaixo dele*; regras `!` não relacionadas não custam nada.
+- **Globs de ignore são compilados uma única vez** — o matcher no estilo gitignore memoiza a regex compilada por padrão em vez de reconstruí-la a cada verificação de caminho (descoberta mais rápida em árvores profundas com arquivos de ignore grandes). Semântica inalterada.
+
+---
+
+## Novidades na 0.6.6
+
+Uma auditoria de paridade com graphify do upstream v0.8.37–v0.8.40 (e issues reportadas até #1362): uma varredura de "verificar e então refutar de forma adversária" sobre 32 candidatos confirmou **6 bugs reais**. O destaque — três extratores de framework produziam silenciosamente *nada*.
+
+- **Apps Express/Koa/Fastify em TypeScript agora extraem rotas** — `express.scm` fixava o nó de nome de classe do JavaScript, que é um "Impossible pattern" sob a gramática do TypeScript, então a query inteira não compilava e o erro era engolido: **apps Express em TS extraíam 0 rotas**. (Apps JavaScript funcionavam, e a única fixture de teste era `.js`, então passou despercebido.) A mesma causa atingia `vue.scm` (SFCs Vue com `<script>` simples → 0 componentes). Ambos agora usam um coringa de nó neutro de gramática que compila em JS e TS.
+- **Arquivos Kotlin em projetos Spring não dão mais erro** — `spring_boot.scm` é uma query de gramática Java mas tinha permissão de rodar contra Kotlin, emitindo `Invalid node type: marker_annotation` e descartando cada arquivo `.kt`. Kotlin agora é bloqueado de forma limpa (Kotlin Spring Boot precisaria de sua própria query).
+- **Gramáticas do tree-sitter têm limites superiores fixados** — `pyproject.toml` fixava as gramáticas sem limite superior (`>=0.23`), então um futuro release de gramática que renomeasse nós da AST poderia quebrar as queries silenciosamente de novo. Cada gramática agora tem um teto de faixa compatível, e um novo teste verifica que cada `.scm` distribuída compila contra cada gramática que declara suportar.
+- **O cache de extração é versionado** — após atualizar o codebeacon, um `--update` incremental podia reutilizar resultados extraídos pela versão *antiga* para arquivos inalterados (um hash de conteúdo não detecta que o extrator mudou). O cache agora carrega a versão do codebeacon e é descartado em caso de divergência.
+- **Nomes acentuados / não ASCII resolvem no macOS** — `codebeacon query` / `path` / MCP e `affected` agora normalizam rótulos e caminhos para Unicode NFC, de modo que um nome copiado de um nome de arquivo do macOS (armazenado como NFD) corresponde ao rótulo NFC no grafo (p. ex. `Auditoría`).
+- Além disso: um `cache.json` corrompido é salvo em backup e reconstruído em vez de ser silenciosamente resetado e sobrescrito.
+
+---
+
 ## Novidades na 0.6.5
 
 `codebeacon upgrade` agora funciona em qualquer ambiente — antes ele presumia uma instalação pip comum e falhava silenciosamente em máquinas onde não era o caso.