codecortex 0.13.0__tar.gz → 0.14.0__tar.gz

{codecortex-0.13.0/src/codecortex.egg-info → codecortex-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.13.0
+Version: 0.14.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -111,7 +111,7 @@ The agent hands `result` straight to the model. If the graph backend isn't insta
 - **It never throws.** Every call returns the same JSON envelope; a missing or broken backend degrades to `null` *with a reason*. No exceptions, no 500s, no malformed output for the agent to trip over — so you never wrap `code.query` in a `try`.
 - **One tool, not three.** Register a single MCP server and it auto-routes each question to graph, LSP, or semantic — instead of wiring up three backends with three response shapes and three failure modes.
 - **Degrades instead of breaking.** No graph backend installed? That engine returns `null` and the agent falls back to grep. The semantic engine needs nothing external, so codeintel is useful the moment it's installed and only gets sharper as you add backends.
-- **Fast on repeat, never stale.** A content-hash cache returns instantly for unchanged code and self-invalidates when a background reindex advances the index — answers stay both quick *and* fresh. The cache is bounded (LRU), so a long-running server holds steady memory.
+- **Fast on repeat, and the cache never lies.** A content-hash cache returns instantly for unchanged code and self-invalidates when a background reindex advances the index, so you never read a cached answer for code that moved on. The cache is bounded (LRU), so a long-running server holds steady memory. (The *cache* is always consistent with the index; how current the index itself is depends on the engine — see [Keeping answers fresh](#keeping-answers-fresh).)
 - **Concurrency-safe.** The HTTP transport handles requests on threads, so one slow query (an LSP session warming, a first-time index) can't block every other agent.
 - **Honest about its own health.** `codeintel doctor` answers three separate questions per engine — *installed?* *runnable?* *is this repo indexed?* — with the single command to fix each gap, so "installed" is never mistaken for "working". And a readiness claim is one a query can actually honor: install a missing backend mid-session and the running server picks it up on the next call, rather than reporting the engine healthy while quietly routing around it until you restart the host.
 
@@ -274,6 +274,34 @@ Every `Gateway.query()` call returns a dict with exactly these keys:
 
 Run `codeintel doctor` at any time to see which engines are actually ready for a repo and how to fix the ones that aren't.
 
+### Keeping answers fresh
+
+The three engines have genuinely different freshness models, and it's worth knowing which you're
+reading:
+
+| Engine | Freshness |
+|---|---|
+| `lsp` | **Live.** Reads your files at query time — always current, no refresh needed. |
+| `semantic` | **Incremental.** A background reindex re-embeds only what changed; `codeintel status` shows the index age. |
+| `graph` | **Snapshot.** Built by `codeintel index` and stale until the next one. |
+
+So a `callers`/`impact`/`hotspots` answer is only as current as your last index. If a result
+describes code you just changed — or a symbol you just added comes back
+`reason: "not-in-graph"` — that's the signal to re-run:
+
+```bash
+codeintel index /path/to/repo
+```
+
+The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
+rather than a bare reason.
+
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation
@@ -297,12 +325,12 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel index [project_root]` | Index a project for semantic search |
 | `codeintel serve` | Start the MCP server (stdio transport) |
 | `codeintel serve-http [--host HOST] [--port 8766] [--allow-remote] [--token TOKEN]` | Start the HTTP transport (loopback-only unless `--allow-remote`; `--token` requires a bearer token on every request) |
-| `codeintel query --op OP --target TARGET [--engine auto]` | Run a single query and print the result |
+| `codeintel query --op OP --target TARGET [--engine auto] [--project-root DIR]` | Run a single query and print the result |
 | `codeintel status [project_root]` | Show engine availability and index age |
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel graph [project_root] [--html] [--out FILE] [--limit N]` | Emit the call graph as `{nodes,edges}` JSON, or `--html` a self-contained interactive viewer — see [docs/graph-viewer.md](docs/graph-viewer.md) |
-| `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
 | `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.

{codecortex-0.13.0 → codecortex-0.14.0}/README.md

@@ -74,7 +74,7 @@ The agent hands `result` straight to the model. If the graph backend isn't insta
 - **It never throws.** Every call returns the same JSON envelope; a missing or broken backend degrades to `null` *with a reason*. No exceptions, no 500s, no malformed output for the agent to trip over — so you never wrap `code.query` in a `try`.
 - **One tool, not three.** Register a single MCP server and it auto-routes each question to graph, LSP, or semantic — instead of wiring up three backends with three response shapes and three failure modes.
 - **Degrades instead of breaking.** No graph backend installed? That engine returns `null` and the agent falls back to grep. The semantic engine needs nothing external, so codeintel is useful the moment it's installed and only gets sharper as you add backends.
-- **Fast on repeat, never stale.** A content-hash cache returns instantly for unchanged code and self-invalidates when a background reindex advances the index — answers stay both quick *and* fresh. The cache is bounded (LRU), so a long-running server holds steady memory.
+- **Fast on repeat, and the cache never lies.** A content-hash cache returns instantly for unchanged code and self-invalidates when a background reindex advances the index, so you never read a cached answer for code that moved on. The cache is bounded (LRU), so a long-running server holds steady memory. (The *cache* is always consistent with the index; how current the index itself is depends on the engine — see [Keeping answers fresh](#keeping-answers-fresh).)
 - **Concurrency-safe.** The HTTP transport handles requests on threads, so one slow query (an LSP session warming, a first-time index) can't block every other agent.
 - **Honest about its own health.** `codeintel doctor` answers three separate questions per engine — *installed?* *runnable?* *is this repo indexed?* — with the single command to fix each gap, so "installed" is never mistaken for "working". And a readiness claim is one a query can actually honor: install a missing backend mid-session and the running server picks it up on the next call, rather than reporting the engine healthy while quietly routing around it until you restart the host.
 
@@ -237,6 +237,34 @@ Every `Gateway.query()` call returns a dict with exactly these keys:
 
 Run `codeintel doctor` at any time to see which engines are actually ready for a repo and how to fix the ones that aren't.
 
+### Keeping answers fresh
+
+The three engines have genuinely different freshness models, and it's worth knowing which you're
+reading:
+
+| Engine | Freshness |
+|---|---|
+| `lsp` | **Live.** Reads your files at query time — always current, no refresh needed. |
+| `semantic` | **Incremental.** A background reindex re-embeds only what changed; `codeintel status` shows the index age. |
+| `graph` | **Snapshot.** Built by `codeintel index` and stale until the next one. |
+
+So a `callers`/`impact`/`hotspots` answer is only as current as your last index. If a result
+describes code you just changed — or a symbol you just added comes back
+`reason: "not-in-graph"` — that's the signal to re-run:
+
+```bash
+codeintel index /path/to/repo
+```
+
+The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
+rather than a bare reason.
+
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation
@@ -260,12 +288,12 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel index [project_root]` | Index a project for semantic search |
 | `codeintel serve` | Start the MCP server (stdio transport) |
 | `codeintel serve-http [--host HOST] [--port 8766] [--allow-remote] [--token TOKEN]` | Start the HTTP transport (loopback-only unless `--allow-remote`; `--token` requires a bearer token on every request) |
-| `codeintel query --op OP --target TARGET [--engine auto]` | Run a single query and print the result |
+| `codeintel query --op OP --target TARGET [--engine auto] [--project-root DIR]` | Run a single query and print the result |
 | `codeintel status [project_root]` | Show engine availability and index age |
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel graph [project_root] [--html] [--out FILE] [--limit N]` | Emit the call graph as `{nodes,edges}` JSON, or `--html` a self-contained interactive viewer — see [docs/graph-viewer.md](docs/graph-viewer.md) |
-| `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
 | `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.

{codecortex-0.13.0 → codecortex-0.14.0/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.13.0
+Version: 0.14.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -111,7 +111,7 @@ The agent hands `result` straight to the model. If the graph backend isn't insta
 - **It never throws.** Every call returns the same JSON envelope; a missing or broken backend degrades to `null` *with a reason*. No exceptions, no 500s, no malformed output for the agent to trip over — so you never wrap `code.query` in a `try`.
 - **One tool, not three.** Register a single MCP server and it auto-routes each question to graph, LSP, or semantic — instead of wiring up three backends with three response shapes and three failure modes.
 - **Degrades instead of breaking.** No graph backend installed? That engine returns `null` and the agent falls back to grep. The semantic engine needs nothing external, so codeintel is useful the moment it's installed and only gets sharper as you add backends.
-- **Fast on repeat, never stale.** A content-hash cache returns instantly for unchanged code and self-invalidates when a background reindex advances the index — answers stay both quick *and* fresh. The cache is bounded (LRU), so a long-running server holds steady memory.
+- **Fast on repeat, and the cache never lies.** A content-hash cache returns instantly for unchanged code and self-invalidates when a background reindex advances the index, so you never read a cached answer for code that moved on. The cache is bounded (LRU), so a long-running server holds steady memory. (The *cache* is always consistent with the index; how current the index itself is depends on the engine — see [Keeping answers fresh](#keeping-answers-fresh).)
 - **Concurrency-safe.** The HTTP transport handles requests on threads, so one slow query (an LSP session warming, a first-time index) can't block every other agent.
 - **Honest about its own health.** `codeintel doctor` answers three separate questions per engine — *installed?* *runnable?* *is this repo indexed?* — with the single command to fix each gap, so "installed" is never mistaken for "working". And a readiness claim is one a query can actually honor: install a missing backend mid-session and the running server picks it up on the next call, rather than reporting the engine healthy while quietly routing around it until you restart the host.
 
@@ -274,6 +274,34 @@ Every `Gateway.query()` call returns a dict with exactly these keys:
 
 Run `codeintel doctor` at any time to see which engines are actually ready for a repo and how to fix the ones that aren't.
 
+### Keeping answers fresh
+
+The three engines have genuinely different freshness models, and it's worth knowing which you're
+reading:
+
+| Engine | Freshness |
+|---|---|
+| `lsp` | **Live.** Reads your files at query time — always current, no refresh needed. |
+| `semantic` | **Incremental.** A background reindex re-embeds only what changed; `codeintel status` shows the index age. |
+| `graph` | **Snapshot.** Built by `codeintel index` and stale until the next one. |
+
+So a `callers`/`impact`/`hotspots` answer is only as current as your last index. If a result
+describes code you just changed — or a symbol you just added comes back
+`reason: "not-in-graph"` — that's the signal to re-run:
+
+```bash
+codeintel index /path/to/repo
+```
+
+The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
+rather than a bare reason.
+
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation
@@ -297,12 +325,12 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel index [project_root]` | Index a project for semantic search |
 | `codeintel serve` | Start the MCP server (stdio transport) |
 | `codeintel serve-http [--host HOST] [--port 8766] [--allow-remote] [--token TOKEN]` | Start the HTTP transport (loopback-only unless `--allow-remote`; `--token` requires a bearer token on every request) |
-| `codeintel query --op OP --target TARGET [--engine auto]` | Run a single query and print the result |
+| `codeintel query --op OP --target TARGET [--engine auto] [--project-root DIR]` | Run a single query and print the result |
 | `codeintel status [project_root]` | Show engine availability and index age |
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel graph [project_root] [--html] [--out FILE] [--limit N]` | Emit the call graph as `{nodes,edges}` JSON, or `--html` a self-contained interactive viewer — see [docs/graph-viewer.md](docs/graph-viewer.md) |
-| `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
 | `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.

codecortex-0.14.0/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.14.0"

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/auth.py

@@ -38,9 +38,11 @@ class TokenAuth:
     """Resolves a bearer token to a role and builds the matching op policy. Tokens are held as
     sha256 hashes; a presented token is hashed and looked up in O(1). Immutable; thread-safe."""
 
-    def __init__(self, token_hash_to_role: dict[str, str], role_ops: dict[str, list[str]]) -> None:
+    def __init__(self, token_hash_to_role: dict[str, str], role_ops: dict[str, list[str]],
+                 role_roots: dict[str, list[str]] | None = None) -> None:
         self._tokens = token_hash_to_role
         self._role_ops = role_ops
+        self._role_roots = role_roots or {}
 
     @property
     def enabled(self) -> bool:
@@ -56,13 +58,19 @@ class TokenAuth:
     def build_policy(self) -> TieringPolicy:
         """A role with ops ``["*"]`` (or none) is unrestricted → omit it from the rules, since
         TieringPolicy treats a role absent from its rules as full-access. Every other role maps to
-        its explicit op allowlist (an empty list = deny all ops, a fail-safe default)."""
+        its explicit op allowlist (an empty list = deny all ops, a fail-safe default).
+
+        ``enabled`` is True whenever RBAC is configured at all — NOT merely when some role has a
+        restricted op list. It used to be ``bool(rules)``, which meant a config whose roles were
+        all ``["*"]`` produced a disabled policy, and a disabled policy enforces no root scoping
+        either. Op behavior is unchanged (a role absent from rules is still unrestricted); this
+        only ensures the root allowlist is actually consulted."""
         rules: dict[str, list[str]] = {}
         for role, ops in self._role_ops.items():
             if _ALL in ops:
                 continue  # unrestricted
             rules[role] = list(ops)
-        return TieringPolicy(enabled=bool(rules), rules=rules)
+        return TieringPolicy(enabled=True, rules=rules, roots=dict(self._role_roots))
 
 
 def _auth_config_path() -> pathlib.Path | None:
@@ -99,6 +107,19 @@ def load_auth() -> TokenAuth:
             logger.warning("auth: role %r ops must be a list (got %r) — denying all ops for it", role, ops)
             role_ops[str(role)] = []
 
+    roots_section = data.get("roots")
+    raw_roots: dict = roots_section if isinstance(roots_section, dict) else {}
+    role_roots: dict[str, list[str]] = {}
+    for role, paths in raw_roots.items():
+        if isinstance(paths, list):
+            role_roots[str(role)] = [str(r) for r in paths]
+        else:
+            # Same fail-CLOSED rule as ops: a bare string (`reader = "/srv/repo"`) is a typo, and
+            # guessing it meant a one-element list would hand out access the operator never wrote.
+            logger.warning("auth: role %r roots must be a list (got %r) — denying all paths for it",
+                           role, paths)
+            role_roots[str(role)] = []
+
     tokens_section = data.get("tokens")
     raw_tokens: dict = tokens_section if isinstance(tokens_section, dict) else {}
     token_hash_to_role: dict[str, str] = {}
@@ -107,6 +128,7 @@ def load_auth() -> TokenAuth:
         # A token mapped to an undefined role fails safe: define it as deny-all (empty op list).
         if role not in role_ops:
             role_ops[role] = []
+        role_roots.setdefault(role, [])
         tok = str(tok)
         if tok[:len(_SHA_PREFIX)].lower() == _SHA_PREFIX:  # case-insensitive `sha256:` prefix
             h = tok[len(_SHA_PREFIX):].strip().lower()
@@ -118,4 +140,13 @@ def load_auth() -> TokenAuth:
     if not token_hash_to_role:
         logger.warning("auth: %s defines no usable [tokens] — RBAC is OFF (no token→role mapping)", path)
 
-    return TokenAuth(token_hash_to_role, role_ops)
+    # A configured-but-unscoped RBAC deployment is the exact shape of the hole this closes, so say
+    # so at load time rather than letting the operator discover it as a wall of 403s.
+    unscoped = sorted(r for r in role_ops if not role_roots.get(r))
+    if token_hash_to_role and unscoped:
+        logger.warning(
+            "auth: roles %s have no [roots] entry and may target NO project — add a [roots] table "
+            "(e.g. `%s = [\"/srv/repos/team-a\"]`, or `= [\"*\"]` for unrestricted)",
+            ", ".join(unscoped), unscoped[0])
+
+    return TokenAuth(token_hash_to_role, role_ops, role_roots)

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/cache.py

@@ -9,9 +9,20 @@ from codeintel.provider import Result
 
 
 def _compute_hash(target: str, project_root: str) -> str:
+    """The cache key's content component: a file target hashes its BYTES, so an edit invalidates.
+
+    A relative target must be resolved against ``project_root``, not the process cwd. It used to
+    use ``os.path.realpath(target)`` alone — and the ops whose target is a path take it
+    repo-relative (`overview` passes it straight through as serena's ``relative_path``). The
+    server is a long-lived singleton answering for whichever ``project_root`` a caller names, so
+    its cwd matches at most one repo and usually none: `inside_root` was false, and every such
+    entry silently fell back to hashing the *string*, which never changes when the file does.
+    That is exactly the "an edit forces a refresh" guarantee docs/architecture.md advertises."""
     try:
         root = os.path.realpath(project_root) if project_root else ""
-        path = os.path.realpath(target)
+        # Relative targets resolve inside the project; absolute ones are already anchored.
+        raw = target if os.path.isabs(target) or not root else os.path.join(root, target)
+        path = os.path.realpath(raw)
         inside_root = (root and path.startswith(root + os.sep)) or path == root
         if inside_root and os.path.isfile(path):
             with open(path, "rb") as fh:

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/commands/graph.py

@@ -6,7 +6,9 @@ from typing import Any
 from codeintel.commands._common import never_raise, resolve_root
 
 
-@never_raise("graph failed: {exc}")
+# code=1: this command's job is to WRITE A FILE. Exiting 0 after failing to write it
+# reports success to any `make`/CI step gating on $? while nothing was produced.
+@never_raise("graph failed: {exc}", code=1)
 def run(args: Any) -> int:
     from codeintel import grapher
 

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/commands/index.py

@@ -12,6 +12,13 @@ def run(args: Any) -> int:
     from codeintel.semantic_db import SemanticDb, default_db_path
 
     project_root = resolve_root(args)
+    # Validate before doing anything. `codeintel index /typo/path` walked nothing, found nothing,
+    # and printed "Nothing new to index" at exit 0 — indistinguishable from a correct incremental
+    # run, which is the worst possible response to a mistyped path in a script.
+    if not os.path.isdir(project_root):
+        print(f"index failed: not a directory: {project_root}")
+        return 1
+    failed = False
     # Wrap the whole semantic pass so a setup failure (e.g. an unresolvable home dir →
     # Path.home() raising) degrades with a message, like every other subcommand, not a traceback.
     try:
@@ -32,12 +39,18 @@ def run(args: Any) -> int:
             ).index(project_root)
             if count > 0:
                 print(f"Indexed {count} chunks")
+            elif count < 0:
+                # Indexer.index() returns -1 for an unrecoverable failure. `> 0` sent that into
+                # the "Nothing new to index" branch, so a total failure read as a clean no-op.
+                print("index failed — the indexer could not complete (see the warnings above)")
+                failed = True
             else:
                 print("Nothing new to index")
         finally:
             db.close()
     except Exception as exc:
         print(f"index failed: {exc}")
+        failed = True
 
     # best-effort graph reindex
     import shutil
@@ -60,4 +73,4 @@ def run(args: Any) -> int:
     except Exception:
         pass
 
-    return 0
+    return 1 if failed else 0

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/commands/map.py

@@ -6,7 +6,9 @@ from codeintel.commands._common import never_raise, resolve_root
 
 
 # Never-raise parity with the MCP code.map handler — degrade, don't crash.
-@never_raise("map failed: {exc}")
+# code=1: this command's job is to WRITE A FILE. Exiting 0 after failing to write it
+# reports success to any `make`/CI step gating on $? while nothing was produced.
+@never_raise("map failed: {exc}", code=1)
 def run(args: Any) -> int:
     from codeintel.injector import Injector
     from codeintel.mapper import MapGenerator

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/gateway.py

@@ -191,6 +191,15 @@ class Gateway:
         except Exception:
             return True
 
+    def allows_root(self, role: str, project_root: str) -> bool:
+        """Whether *role* may target *project_root*. The companion to ``allows`` — an op gate alone
+        leaves the TARGET unbounded, which is how `doctor` and `status` could still be pointed at
+        any readable directory after `query` had been scoped."""
+        try:
+            return self._policy is None or self._policy.is_root_allowed(role, project_root)
+        except Exception:
+            return True
+
     def query(
         self,
         op=None,
@@ -206,14 +215,21 @@ class Gateway:
             engine_str = str(engine or "").strip() or "auto"
             was_auto = engine_str == "auto"
 
-            # Policy check FIRST — a role denied for this op does NO work (no reindex, no dispatch,
-            # no cache lookup). Applies to the modern provider path; the legacy list path has none.
-            if (
-                self._legacy_providers is None
-                and self._policy is not None
-                and not self._policy.is_allowed(role, op_str)
-            ):
-                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+            # Policy check FIRST — a role denied here does NO work (no reindex, no dispatch, no
+            # cache lookup, and critically no on-demand indexing walk). Applies to the modern
+            # provider path; the legacy list path has none.
+            if self._legacy_providers is None and self._policy is not None:
+                if not self._policy.is_allowed(role, op_str):
+                    return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+                # `project_root` arrives in the request body. Without this check any role able to
+                # call `search` could name ANY directory the server process can read, and the
+                # semantic provider would walk, index, and return its contents — an op allowlist
+                # never sees the target. Denied before maybe_reindex, so a rejected path is not
+                # even touched.
+                if not self._policy.is_root_allowed(role, str(project_root or "")):
+                    return safe_null_result(op_str, target_str, reason="root-not-allowed-for-role",
+                                            hint="this token's role is not scoped to that "
+                                                 "project_root (see the [roots] table in auth.toml)")
 
             try:
                 self._reindexer.maybe_reindex(str(project_root or ""))
@@ -240,6 +256,15 @@ class Gateway:
             if engine_str == "auto":
                 engine_str = _AUTO_ENGINE.get(op_str, "graph")
 
+            # Cache under what was ASKED, not what auto resolved to. `auto` and an explicit
+            # `graph` both resolved to "graph" and so shared one key — but they are different
+            # questions: `auto` accepts the overview LSP fallback below, an explicit `graph`
+            # does not. One `auto` miss therefore parked an LSP answer under the graph key, and
+            # the next explicit `engine=graph` request got it back with `cached: true` and an
+            # `engine: "lsp"` field contradicting its own request. Reachable on any cold start,
+            # since "graph not indexed yet" is the normal first-query state.
+            cache_engine = "auto" if was_auto else engine_str
+
             root_str = project_root or ""
 
             # Freshness token — bumps when a background reindex completes, so a cached
@@ -259,7 +284,7 @@ class Gateway:
             if engine_str in _FANOUT_ENGINES:
                 cached_result = (
                     None if uncacheable
-                    else self._cache.get(op_str, target_str, engine_str, root_str, freshness)
+                    else self._cache.get(op_str, target_str, cache_engine, root_str, freshness)
                 )
                 if cached_result is not None:
                     return {**cached_result, "cached": True}
@@ -268,13 +293,13 @@ class Gateway:
                 fan_results = self._fan_out(engines, op_str, target_str, budget, project_root)
                 result = self._merge(fan_results, op_str, target_str, engine_str)
                 if not uncacheable:
-                    self._cache.put(op_str, target_str, engine_str, root_str, result, freshness)
+                    self._cache.put(op_str, target_str, cache_engine, root_str, result, freshness)
                 return result
 
             # Single-engine dispatch (`uncacheable`, computed above, also guards this path).
             cached_result = (
                 None if uncacheable
-                else self._cache.get(op_str, target_str, engine_str, root_str, freshness)
+                else self._cache.get(op_str, target_str, cache_engine, root_str, freshness)
             )
             if cached_result is not None:
                 return {**cached_result, "cached": True}
@@ -298,7 +323,7 @@ class Gateway:
                     result = lsp_result
 
             if not uncacheable:
-                self._cache.put(op_str, target_str, engine_str, root_str, result, freshness)
+                self._cache.put(op_str, target_str, cache_engine, root_str, result, freshness)
             return result
 
         except Exception as exc:

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/http_server.py

@@ -168,8 +168,10 @@ class _Handler(BaseHTTPRequestHandler):
             return
 
         # Everything else is auth-gated when auth is configured (metrics can reveal usage patterns;
-        # status reveals engine/index state). Any valid token/role may read these operational views.
-        ok, _ = self._resolve_role()
+        # status reveals engine/index state). The role is kept, not discarded: /code/status takes a
+        # project_root, and answering it for any path regardless of the role's [roots] was the same
+        # cross-tenant disclosure that scoping /code/query was meant to close.
+        ok, role = self._resolve_role()
         if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
@@ -185,7 +187,9 @@ class _Handler(BaseHTTPRequestHandler):
             return
         if path == "/code/status":
             project_root = (parse_qs(parsed.query).get("project_root") or [""])[0]
-            self._send_json(200, code_status_handler({"project_root": project_root}))
+            # role is server-authoritative, exactly as on the POST path — never read from input.
+            self._send_json(200, code_status_handler(
+                {"project_root": project_root, "role": role}))
             return
         self._send_json(404, {"error": "not-found"})
 

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/indexer.py

@@ -13,6 +13,11 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+# Hard ceiling on the characters embedded for ONE chunk. Line-based splitting cannot bound a
+# minified or generated single-line file, and the embedder's memory use scales with input size.
+# Generous enough that no hand-written function is affected.
+_MAX_CHUNK_CHARS = 200_000
+
 _INDEXED_EXTS = frozenset({
     ".py", ".md",
     ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",       # TS/JS variants
@@ -206,7 +211,21 @@ class Indexer:
             logger.warning("Cleanup pass failed: %s", exc)
 
     def _walk_files(self, root: Path):
+        """Indexable files inside *root* — and strictly inside it.
+
+        ``os.walk`` defaults to ``followlinks=False``, which stops recursion into symlinked
+        DIRECTORIES but says nothing about symlinked FILES: those still appear in ``filenames``,
+        and the later ``open()`` follows them transparently. That made a planted symlink a
+        complete bypass of RBAC project scoping — a tenant able to write inside their own allowed
+        root could link to any file the server process can read and have it indexed, embedded, and
+        returned as a search snippet. Demonstrated before this guard existed.
+
+        So every candidate is resolved and required to land back under the resolved root."""
         ignores = set(_SKIP_DIRS) | set(_DEFAULT_IGNORES) | self._load_gitignore(root)
+        try:
+            real_root = os.path.realpath(root)
+        except Exception:
+            real_root = str(root)
         for dirpath, dirnames, filenames in os.walk(root):
             dirnames[:] = [
                 d for d in dirnames
@@ -215,8 +234,32 @@ class Indexer:
             for fname in filenames:
                 if fname in ignores:
                     continue
-                if Path(fname).suffix.lower() in _INDEXED_EXTS:
-                    yield Path(dirpath) / fname
+                if Path(fname).suffix.lower() not in _INDEXED_EXTS:
+                    continue
+                candidate = Path(dirpath) / fname
+                try:
+                    real = os.path.realpath(candidate)
+                except Exception:
+                    continue
+                if real != real_root and not real.startswith(real_root + os.sep):
+                    logger.warning("skipping %s — it resolves outside the indexed root", candidate)
+                    continue
+                # A HARDLINK is a second directory entry for the same inode. It is physically
+                # inside the root, so its realpath is inside the root and the check above passes
+                # — `realpath` cannot see it. That reopened exactly the hole the symlink guard
+                # closes: a tenant able to write in their own root could `ln` another tenant's
+                # file in and have it indexed. There is no way to ask "does this inode also live
+                # outside?", so treat extra links as disqualifying. Measured at 0 occurrences
+                # across 3213 source files of a real repo, so the false-positive cost is nil.
+                try:
+                    links = os.stat(real).st_nlink
+                except OSError:
+                    continue
+                if links > 1:
+                    logger.warning("skipping %s — %d hard links, so its content may also live "
+                                   "outside the indexed root", candidate, links)
+                    continue
+                yield candidate
 
     # ---- chunk-span computation ------------------------------------------------------------
     # A file is turned into a list of 0-based, half-open ``(start, end)`` line spans; every
@@ -451,6 +494,17 @@ class Indexer:
             if not chunk_lines:
                 continue
             chunk_text = "".join(chunk_lines)
+            # Cap chunk BYTES, not just lines. `_maybe_split` splits on line boundaries, so a
+            # minified bundle or a generated one-liner is a single unsplittable chunk however
+            # large: a 20MB one-line .py peaked at 3.4GB RSS through the embedder, and a 40MB
+            # one extrapolates past 8GB. That runs on the reindexer's daemon thread inside the
+            # long-lived MCP server, so it can take the agent host down, not just a CLI run.
+            # Truncation is the right trade — the head of a chunk carries its identifying
+            # content, and an over-long minified line has no retrieval value past that anyway.
+            if len(chunk_text) > _MAX_CHUNK_CHARS:
+                logger.warning("truncating an oversized chunk in %s (%d chars) to %d",
+                               rel_path, len(chunk_text), _MAX_CHUNK_CHARS)
+                chunk_text = chunk_text[:_MAX_CHUNK_CHARS]
             if not chunk_text.strip():
                 # EC3.4: never embed empty/whitespace-only chunks (zero vectors pollute results).
                 chunk_count += 1

{codecortex-0.13.0 → codecortex-0.14.0}/src/codeintel/injector.py

@@ -49,7 +49,9 @@ def _find_context_file(project_root: str) -> str | None:
 
 def _read_file(path: str) -> str | None:
     try:
-        with open(path, encoding="utf-8", errors="strict") as f:
+        # newline="" keeps the file's own line endings intact. Universal-newline mode silently
+        # converted a CRLF file to LF on write, producing a whole-file diff on every --inject.
+        with open(path, encoding="utf-8", errors="strict", newline="") as f:
             return f.read()
     except Exception as exc:
         _logger.warning("Injector: could not read %s: %s", path, exc)
@@ -59,10 +61,26 @@ def _read_file(path: str) -> str | None:
 def _write_file(path: str, content: str) -> None:
     # Atomic: write a sibling temp file then os.replace it into place, so an interrupted
     # write can never leave the user's CLAUDE.md/AGENTS.md truncated or half-written.
-    tmp = path + ".codeintel.tmp"
-    with open(tmp, "w", encoding="utf-8") as f:
+    #
+    # os.replace swaps in a NEW inode, so without care it also (a) drops the original's
+    # permissions in favour of whatever the umask gives, and (b) replaces a symlinked
+    # CLAUDE.md — a dotfile-manager or shared-team-rules setup — with a regular file, orphaning
+    # the source. Resolve the link and carry the mode across.
+    target = os.path.realpath(path)
+    try:
+        mode: int | None = os.stat(target).st_mode & 0o7777
+    except OSError:
+        mode = None
+
+    tmp = target + ".codeintel.tmp"
+    with open(tmp, "w", encoding="utf-8", newline="") as f:
         f.write(content)
-    os.replace(tmp, path)
+    if mode is not None:
+        try:
+            os.chmod(tmp, mode)
+        except OSError:
+            pass
+    os.replace(tmp, target)
 
 
 def _update_block(content: str) -> tuple[str, str]:
@@ -73,9 +91,20 @@ def _update_block(content: str) -> tuple[str, str]:
 
     if has_start and has_end:
         start_idx = content.index(_START_MARKER)
-        end_idx = content.index(_END_MARKER) + len(_END_MARKER)
-        new_content = content[:start_idx] + block + content[end_idx:]
-        return (new_content, "updated")
+        # The END marker must be searched for AFTER the start. `content.index(_END_MARKER)` finds
+        # the FIRST one, which can sit before start_idx — a hand-edit, a bad merge, or this
+        # function's own append branch below, which happily creates that ordering. The slice
+        # `content[:start_idx] + block + content[end_idx:]` then RE-EMITS everything between the
+        # stray marker and the block, duplicating the user's own instructions once per run and
+        # growing without bound. CLAUDE.md is prompt context, so this silently degrades the agent
+        # it is supposed to help.
+        end_rel = content.find(_END_MARKER, start_idx)
+        if end_rel != -1:
+            end_idx = end_rel + len(_END_MARKER)
+            return (content[:start_idx] + block + content[end_idx:], "updated")
+        # Start with no end after it: the block is truncated. Replace from the start marker to
+        # the end of the file rather than splicing around a marker that precedes it.
+        return (content[:start_idx] + block, "repaired")
 
     # Missing or corrupted (only one marker): append a fresh block
     separator = "\n\n" if not content.endswith("\n\n") else ""