codecortex 0.13.1__tar.gz → 0.14.0__tar.gz

{codecortex-0.13.1/src/codecortex.egg-info → codecortex-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.13.1
+Version: 0.14.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -296,6 +296,12 @@ codeintel index /path/to/repo
 The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
 rather than a bare reason.
 
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation

{codecortex-0.13.1 → codecortex-0.14.0}/README.md

@@ -259,6 +259,12 @@ codeintel index /path/to/repo
 The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
 rather than a bare reason.
 
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation

{codecortex-0.13.1 → codecortex-0.14.0/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.13.1
+Version: 0.14.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -296,6 +296,12 @@ codeintel index /path/to/repo
 The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
 rather than a bare reason.
 
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation

codecortex-0.14.0/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.14.0"

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/auth.py

@@ -38,9 +38,11 @@ class TokenAuth:
     """Resolves a bearer token to a role and builds the matching op policy. Tokens are held as
     sha256 hashes; a presented token is hashed and looked up in O(1). Immutable; thread-safe."""
 
-    def __init__(self, token_hash_to_role: dict[str, str], role_ops: dict[str, list[str]]) -> None:
+    def __init__(self, token_hash_to_role: dict[str, str], role_ops: dict[str, list[str]],
+                 role_roots: dict[str, list[str]] | None = None) -> None:
         self._tokens = token_hash_to_role
         self._role_ops = role_ops
+        self._role_roots = role_roots or {}
 
     @property
     def enabled(self) -> bool:
@@ -56,13 +58,19 @@ class TokenAuth:
     def build_policy(self) -> TieringPolicy:
         """A role with ops ``["*"]`` (or none) is unrestricted → omit it from the rules, since
         TieringPolicy treats a role absent from its rules as full-access. Every other role maps to
-        its explicit op allowlist (an empty list = deny all ops, a fail-safe default)."""
+        its explicit op allowlist (an empty list = deny all ops, a fail-safe default).
+
+        ``enabled`` is True whenever RBAC is configured at all — NOT merely when some role has a
+        restricted op list. It used to be ``bool(rules)``, which meant a config whose roles were
+        all ``["*"]`` produced a disabled policy, and a disabled policy enforces no root scoping
+        either. Op behavior is unchanged (a role absent from rules is still unrestricted); this
+        only ensures the root allowlist is actually consulted."""
         rules: dict[str, list[str]] = {}
         for role, ops in self._role_ops.items():
             if _ALL in ops:
                 continue  # unrestricted
             rules[role] = list(ops)
-        return TieringPolicy(enabled=bool(rules), rules=rules)
+        return TieringPolicy(enabled=True, rules=rules, roots=dict(self._role_roots))
 
 
 def _auth_config_path() -> pathlib.Path | None:
@@ -99,6 +107,19 @@ def load_auth() -> TokenAuth:
             logger.warning("auth: role %r ops must be a list (got %r) — denying all ops for it", role, ops)
             role_ops[str(role)] = []
 
+    roots_section = data.get("roots")
+    raw_roots: dict = roots_section if isinstance(roots_section, dict) else {}
+    role_roots: dict[str, list[str]] = {}
+    for role, paths in raw_roots.items():
+        if isinstance(paths, list):
+            role_roots[str(role)] = [str(r) for r in paths]
+        else:
+            # Same fail-CLOSED rule as ops: a bare string (`reader = "/srv/repo"`) is a typo, and
+            # guessing it meant a one-element list would hand out access the operator never wrote.
+            logger.warning("auth: role %r roots must be a list (got %r) — denying all paths for it",
+                           role, paths)
+            role_roots[str(role)] = []
+
     tokens_section = data.get("tokens")
     raw_tokens: dict = tokens_section if isinstance(tokens_section, dict) else {}
     token_hash_to_role: dict[str, str] = {}
@@ -107,6 +128,7 @@ def load_auth() -> TokenAuth:
         # A token mapped to an undefined role fails safe: define it as deny-all (empty op list).
         if role not in role_ops:
             role_ops[role] = []
+        role_roots.setdefault(role, [])
         tok = str(tok)
         if tok[:len(_SHA_PREFIX)].lower() == _SHA_PREFIX:  # case-insensitive `sha256:` prefix
             h = tok[len(_SHA_PREFIX):].strip().lower()
@@ -118,4 +140,13 @@ def load_auth() -> TokenAuth:
     if not token_hash_to_role:
         logger.warning("auth: %s defines no usable [tokens] — RBAC is OFF (no token→role mapping)", path)
 
-    return TokenAuth(token_hash_to_role, role_ops)
+    # A configured-but-unscoped RBAC deployment is the exact shape of the hole this closes, so say
+    # so at load time rather than letting the operator discover it as a wall of 403s.
+    unscoped = sorted(r for r in role_ops if not role_roots.get(r))
+    if token_hash_to_role and unscoped:
+        logger.warning(
+            "auth: roles %s have no [roots] entry and may target NO project — add a [roots] table "
+            "(e.g. `%s = [\"/srv/repos/team-a\"]`, or `= [\"*\"]` for unrestricted)",
+            ", ".join(unscoped), unscoped[0])
+
+    return TokenAuth(token_hash_to_role, role_ops, role_roots)

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/cache.py

@@ -9,9 +9,20 @@ from codeintel.provider import Result
 
 
 def _compute_hash(target: str, project_root: str) -> str:
+    """The cache key's content component: a file target hashes its BYTES, so an edit invalidates.
+
+    A relative target must be resolved against ``project_root``, not the process cwd. It used to
+    use ``os.path.realpath(target)`` alone — and the ops whose target is a path take it
+    repo-relative (`overview` passes it straight through as serena's ``relative_path``). The
+    server is a long-lived singleton answering for whichever ``project_root`` a caller names, so
+    its cwd matches at most one repo and usually none: `inside_root` was false, and every such
+    entry silently fell back to hashing the *string*, which never changes when the file does.
+    That is exactly the "an edit forces a refresh" guarantee docs/architecture.md advertises."""
     try:
         root = os.path.realpath(project_root) if project_root else ""
-        path = os.path.realpath(target)
+        # Relative targets resolve inside the project; absolute ones are already anchored.
+        raw = target if os.path.isabs(target) or not root else os.path.join(root, target)
+        path = os.path.realpath(raw)
         inside_root = (root and path.startswith(root + os.sep)) or path == root
         if inside_root and os.path.isfile(path):
             with open(path, "rb") as fh:

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/commands/graph.py

@@ -6,7 +6,9 @@ from typing import Any
 from codeintel.commands._common import never_raise, resolve_root
 
 
-@never_raise("graph failed: {exc}")
+# code=1: this command's job is to WRITE A FILE. Exiting 0 after failing to write it
+# reports success to any `make`/CI step gating on $? while nothing was produced.
+@never_raise("graph failed: {exc}", code=1)
 def run(args: Any) -> int:
     from codeintel import grapher
 

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/commands/index.py

@@ -12,6 +12,13 @@ def run(args: Any) -> int:
     from codeintel.semantic_db import SemanticDb, default_db_path
 
     project_root = resolve_root(args)
+    # Validate before doing anything. `codeintel index /typo/path` walked nothing, found nothing,
+    # and printed "Nothing new to index" at exit 0 — indistinguishable from a correct incremental
+    # run, which is the worst possible response to a mistyped path in a script.
+    if not os.path.isdir(project_root):
+        print(f"index failed: not a directory: {project_root}")
+        return 1
+    failed = False
     # Wrap the whole semantic pass so a setup failure (e.g. an unresolvable home dir →
     # Path.home() raising) degrades with a message, like every other subcommand, not a traceback.
     try:
@@ -32,12 +39,18 @@ def run(args: Any) -> int:
             ).index(project_root)
             if count > 0:
                 print(f"Indexed {count} chunks")
+            elif count < 0:
+                # Indexer.index() returns -1 for an unrecoverable failure. `> 0` sent that into
+                # the "Nothing new to index" branch, so a total failure read as a clean no-op.
+                print("index failed — the indexer could not complete (see the warnings above)")
+                failed = True
             else:
                 print("Nothing new to index")
         finally:
             db.close()
     except Exception as exc:
         print(f"index failed: {exc}")
+        failed = True
 
     # best-effort graph reindex
     import shutil
@@ -60,4 +73,4 @@ def run(args: Any) -> int:
     except Exception:
         pass
 
-    return 0
+    return 1 if failed else 0

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/commands/map.py

@@ -6,7 +6,9 @@ from codeintel.commands._common import never_raise, resolve_root
 
 
 # Never-raise parity with the MCP code.map handler — degrade, don't crash.
-@never_raise("map failed: {exc}")
+# code=1: this command's job is to WRITE A FILE. Exiting 0 after failing to write it
+# reports success to any `make`/CI step gating on $? while nothing was produced.
+@never_raise("map failed: {exc}", code=1)
 def run(args: Any) -> int:
     from codeintel.injector import Injector
     from codeintel.mapper import MapGenerator

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/gateway.py

@@ -191,6 +191,15 @@ class Gateway:
         except Exception:
             return True
 
+    def allows_root(self, role: str, project_root: str) -> bool:
+        """Whether *role* may target *project_root*. The companion to ``allows`` — an op gate alone
+        leaves the TARGET unbounded, which is how `doctor` and `status` could still be pointed at
+        any readable directory after `query` had been scoped."""
+        try:
+            return self._policy is None or self._policy.is_root_allowed(role, project_root)
+        except Exception:
+            return True
+
     def query(
         self,
         op=None,
@@ -206,14 +215,21 @@ class Gateway:
             engine_str = str(engine or "").strip() or "auto"
             was_auto = engine_str == "auto"
 
-            # Policy check FIRST — a role denied for this op does NO work (no reindex, no dispatch,
-            # no cache lookup). Applies to the modern provider path; the legacy list path has none.
-            if (
-                self._legacy_providers is None
-                and self._policy is not None
-                and not self._policy.is_allowed(role, op_str)
-            ):
-                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+            # Policy check FIRST — a role denied here does NO work (no reindex, no dispatch, no
+            # cache lookup, and critically no on-demand indexing walk). Applies to the modern
+            # provider path; the legacy list path has none.
+            if self._legacy_providers is None and self._policy is not None:
+                if not self._policy.is_allowed(role, op_str):
+                    return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+                # `project_root` arrives in the request body. Without this check any role able to
+                # call `search` could name ANY directory the server process can read, and the
+                # semantic provider would walk, index, and return its contents — an op allowlist
+                # never sees the target. Denied before maybe_reindex, so a rejected path is not
+                # even touched.
+                if not self._policy.is_root_allowed(role, str(project_root or "")):
+                    return safe_null_result(op_str, target_str, reason="root-not-allowed-for-role",
+                                            hint="this token's role is not scoped to that "
+                                                 "project_root (see the [roots] table in auth.toml)")
 
             try:
                 self._reindexer.maybe_reindex(str(project_root or ""))
@@ -240,6 +256,15 @@ class Gateway:
             if engine_str == "auto":
                 engine_str = _AUTO_ENGINE.get(op_str, "graph")
 
+            # Cache under what was ASKED, not what auto resolved to. `auto` and an explicit
+            # `graph` both resolved to "graph" and so shared one key — but they are different
+            # questions: `auto` accepts the overview LSP fallback below, an explicit `graph`
+            # does not. One `auto` miss therefore parked an LSP answer under the graph key, and
+            # the next explicit `engine=graph` request got it back with `cached: true` and an
+            # `engine: "lsp"` field contradicting its own request. Reachable on any cold start,
+            # since "graph not indexed yet" is the normal first-query state.
+            cache_engine = "auto" if was_auto else engine_str
+
             root_str = project_root or ""
 
             # Freshness token — bumps when a background reindex completes, so a cached
@@ -259,7 +284,7 @@ class Gateway:
             if engine_str in _FANOUT_ENGINES:
                 cached_result = (
                     None if uncacheable
-                    else self._cache.get(op_str, target_str, engine_str, root_str, freshness)
+                    else self._cache.get(op_str, target_str, cache_engine, root_str, freshness)
                 )
                 if cached_result is not None:
                     return {**cached_result, "cached": True}
@@ -268,13 +293,13 @@ class Gateway:
                 fan_results = self._fan_out(engines, op_str, target_str, budget, project_root)
                 result = self._merge(fan_results, op_str, target_str, engine_str)
                 if not uncacheable:
-                    self._cache.put(op_str, target_str, engine_str, root_str, result, freshness)
+                    self._cache.put(op_str, target_str, cache_engine, root_str, result, freshness)
                 return result
 
             # Single-engine dispatch (`uncacheable`, computed above, also guards this path).
             cached_result = (
                 None if uncacheable
-                else self._cache.get(op_str, target_str, engine_str, root_str, freshness)
+                else self._cache.get(op_str, target_str, cache_engine, root_str, freshness)
             )
             if cached_result is not None:
                 return {**cached_result, "cached": True}
@@ -298,7 +323,7 @@ class Gateway:
                     result = lsp_result
 
             if not uncacheable:
-                self._cache.put(op_str, target_str, engine_str, root_str, result, freshness)
+                self._cache.put(op_str, target_str, cache_engine, root_str, result, freshness)
             return result
 
         except Exception as exc:

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/http_server.py

@@ -168,8 +168,10 @@ class _Handler(BaseHTTPRequestHandler):
             return
 
         # Everything else is auth-gated when auth is configured (metrics can reveal usage patterns;
-        # status reveals engine/index state). Any valid token/role may read these operational views.
-        ok, _ = self._resolve_role()
+        # status reveals engine/index state). The role is kept, not discarded: /code/status takes a
+        # project_root, and answering it for any path regardless of the role's [roots] was the same
+        # cross-tenant disclosure that scoping /code/query was meant to close.
+        ok, role = self._resolve_role()
         if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
@@ -185,7 +187,9 @@ class _Handler(BaseHTTPRequestHandler):
             return
         if path == "/code/status":
             project_root = (parse_qs(parsed.query).get("project_root") or [""])[0]
-            self._send_json(200, code_status_handler({"project_root": project_root}))
+            # role is server-authoritative, exactly as on the POST path — never read from input.
+            self._send_json(200, code_status_handler(
+                {"project_root": project_root, "role": role}))
             return
         self._send_json(404, {"error": "not-found"})
 

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/indexer.py

@@ -13,6 +13,11 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+# Hard ceiling on the characters embedded for ONE chunk. Line-based splitting cannot bound a
+# minified or generated single-line file, and the embedder's memory use scales with input size.
+# Generous enough that no hand-written function is affected.
+_MAX_CHUNK_CHARS = 200_000
+
 _INDEXED_EXTS = frozenset({
     ".py", ".md",
     ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",       # TS/JS variants
@@ -206,7 +211,21 @@ class Indexer:
             logger.warning("Cleanup pass failed: %s", exc)
 
     def _walk_files(self, root: Path):
+        """Indexable files inside *root* — and strictly inside it.
+
+        ``os.walk`` defaults to ``followlinks=False``, which stops recursion into symlinked
+        DIRECTORIES but says nothing about symlinked FILES: those still appear in ``filenames``,
+        and the later ``open()`` follows them transparently. That made a planted symlink a
+        complete bypass of RBAC project scoping — a tenant able to write inside their own allowed
+        root could link to any file the server process can read and have it indexed, embedded, and
+        returned as a search snippet. Demonstrated before this guard existed.
+
+        So every candidate is resolved and required to land back under the resolved root."""
         ignores = set(_SKIP_DIRS) | set(_DEFAULT_IGNORES) | self._load_gitignore(root)
+        try:
+            real_root = os.path.realpath(root)
+        except Exception:
+            real_root = str(root)
         for dirpath, dirnames, filenames in os.walk(root):
             dirnames[:] = [
                 d for d in dirnames
@@ -215,8 +234,32 @@ class Indexer:
             for fname in filenames:
                 if fname in ignores:
                     continue
-                if Path(fname).suffix.lower() in _INDEXED_EXTS:
-                    yield Path(dirpath) / fname
+                if Path(fname).suffix.lower() not in _INDEXED_EXTS:
+                    continue
+                candidate = Path(dirpath) / fname
+                try:
+                    real = os.path.realpath(candidate)
+                except Exception:
+                    continue
+                if real != real_root and not real.startswith(real_root + os.sep):
+                    logger.warning("skipping %s — it resolves outside the indexed root", candidate)
+                    continue
+                # A HARDLINK is a second directory entry for the same inode. It is physically
+                # inside the root, so its realpath is inside the root and the check above passes
+                # — `realpath` cannot see it. That reopened exactly the hole the symlink guard
+                # closes: a tenant able to write in their own root could `ln` another tenant's
+                # file in and have it indexed. There is no way to ask "does this inode also live
+                # outside?", so treat extra links as disqualifying. Measured at 0 occurrences
+                # across 3213 source files of a real repo, so the false-positive cost is nil.
+                try:
+                    links = os.stat(real).st_nlink
+                except OSError:
+                    continue
+                if links > 1:
+                    logger.warning("skipping %s — %d hard links, so its content may also live "
+                                   "outside the indexed root", candidate, links)
+                    continue
+                yield candidate
 
     # ---- chunk-span computation ------------------------------------------------------------
     # A file is turned into a list of 0-based, half-open ``(start, end)`` line spans; every
@@ -451,6 +494,17 @@ class Indexer:
             if not chunk_lines:
                 continue
             chunk_text = "".join(chunk_lines)
+            # Cap chunk BYTES, not just lines. `_maybe_split` splits on line boundaries, so a
+            # minified bundle or a generated one-liner is a single unsplittable chunk however
+            # large: a 20MB one-line .py peaked at 3.4GB RSS through the embedder, and a 40MB
+            # one extrapolates past 8GB. That runs on the reindexer's daemon thread inside the
+            # long-lived MCP server, so it can take the agent host down, not just a CLI run.
+            # Truncation is the right trade — the head of a chunk carries its identifying
+            # content, and an over-long minified line has no retrieval value past that anyway.
+            if len(chunk_text) > _MAX_CHUNK_CHARS:
+                logger.warning("truncating an oversized chunk in %s (%d chars) to %d",
+                               rel_path, len(chunk_text), _MAX_CHUNK_CHARS)
+                chunk_text = chunk_text[:_MAX_CHUNK_CHARS]
             if not chunk_text.strip():
                 # EC3.4: never embed empty/whitespace-only chunks (zero vectors pollute results).
                 chunk_count += 1

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/injector.py

@@ -49,7 +49,9 @@ def _find_context_file(project_root: str) -> str | None:
 
 def _read_file(path: str) -> str | None:
     try:
-        with open(path, encoding="utf-8", errors="strict") as f:
+        # newline="" keeps the file's own line endings intact. Universal-newline mode silently
+        # converted a CRLF file to LF on write, producing a whole-file diff on every --inject.
+        with open(path, encoding="utf-8", errors="strict", newline="") as f:
             return f.read()
     except Exception as exc:
         _logger.warning("Injector: could not read %s: %s", path, exc)
@@ -59,10 +61,26 @@ def _read_file(path: str) -> str | None:
 def _write_file(path: str, content: str) -> None:
     # Atomic: write a sibling temp file then os.replace it into place, so an interrupted
     # write can never leave the user's CLAUDE.md/AGENTS.md truncated or half-written.
-    tmp = path + ".codeintel.tmp"
-    with open(tmp, "w", encoding="utf-8") as f:
+    #
+    # os.replace swaps in a NEW inode, so without care it also (a) drops the original's
+    # permissions in favour of whatever the umask gives, and (b) replaces a symlinked
+    # CLAUDE.md — a dotfile-manager or shared-team-rules setup — with a regular file, orphaning
+    # the source. Resolve the link and carry the mode across.
+    target = os.path.realpath(path)
+    try:
+        mode: int | None = os.stat(target).st_mode & 0o7777
+    except OSError:
+        mode = None
+
+    tmp = target + ".codeintel.tmp"
+    with open(tmp, "w", encoding="utf-8", newline="") as f:
         f.write(content)
-    os.replace(tmp, path)
+    if mode is not None:
+        try:
+            os.chmod(tmp, mode)
+        except OSError:
+            pass
+    os.replace(tmp, target)
 
 
 def _update_block(content: str) -> tuple[str, str]:
@@ -73,9 +91,20 @@ def _update_block(content: str) -> tuple[str, str]:
 
     if has_start and has_end:
         start_idx = content.index(_START_MARKER)
-        end_idx = content.index(_END_MARKER) + len(_END_MARKER)
-        new_content = content[:start_idx] + block + content[end_idx:]
-        return (new_content, "updated")
+        # The END marker must be searched for AFTER the start. `content.index(_END_MARKER)` finds
+        # the FIRST one, which can sit before start_idx — a hand-edit, a bad merge, or this
+        # function's own append branch below, which happily creates that ordering. The slice
+        # `content[:start_idx] + block + content[end_idx:]` then RE-EMITS everything between the
+        # stray marker and the block, duplicating the user's own instructions once per run and
+        # growing without bound. CLAUDE.md is prompt context, so this silently degrades the agent
+        # it is supposed to help.
+        end_rel = content.find(_END_MARKER, start_idx)
+        if end_rel != -1:
+            end_idx = end_rel + len(_END_MARKER)
+            return (content[:start_idx] + block + content[end_idx:], "updated")
+        # Start with no end after it: the block is truncated. Replace from the start marker to
+        # the end of the file rather than splicing around a marker that precedes it.
+        return (content[:start_idx] + block, "repaired")
 
     # Missing or corrupted (only one marker): append a fresh block
     separator = "\n\n" if not content.endswith("\n\n") else ""

{codecortex-0.13.1 → codecortex-0.14.0}/src/codeintel/installer.py

@@ -34,9 +34,30 @@ def _atomic_write_text(path: pathlib.Path, text: str) -> None:
     """Write via a sibling temp file + os.replace so an interrupted write can never truncate
     the user's existing agent config (which holds unrelated settings) to a partial/empty file.
     The temp lives in the same directory as ``path`` so the replace stays on one filesystem."""
-    tmp = path.with_name(path.name + ".codeintel.tmp")
+    #
+    # os.replace installs a NEW inode, which without care also (a) drops the original's
+    # permissions in favour of the umask — ~/.claude.json holds OAuth tokens and per-server env
+    # secrets and is typically 0600, so this quietly widened it to 0644 — and (b) replaces a
+    # symlinked config (chezmoi/stow/yadm) with a regular file, orphaning the real source.
+    target = pathlib.Path(os.path.realpath(path))
+    try:
+        mode: int | None = target.stat().st_mode & 0o7777
+    except OSError:
+        mode = None
+
+    tmp = target.with_name(target.name + ".codeintel.tmp")
     tmp.write_text(text, encoding="utf-8")
-    os.replace(tmp, path)
+    if mode is not None:
+        try:
+            os.chmod(tmp, mode)
+        except OSError:
+            pass
+    else:
+        try:                       # a config we are creating holds secrets — don't inherit 0644
+            os.chmod(tmp, 0o600)
+        except OSError:
+            pass
+    os.replace(tmp, target)
 
 
 # Per-agent registration recipe.
@@ -292,7 +313,13 @@ class Installer:
         if config_path.exists():
             data = json.loads(config_path.read_text(encoding="utf-8"))
             if not isinstance(data, dict):
-                data = {}
+                # Every other malformed-input path here fails safe (invalid JSON → failed, no
+                # write). Silently substituting {} made this the one branch that DESTROYED the
+                # file: a top-level array or string was replaced wholesale, exit 0, reported
+                # "registered". Refuse instead — the user can look at it and decide.
+                raise ValueError(
+                    f"{config_path} does not contain a JSON object (found "
+                    f"{type(data).__name__}) — refusing to overwrite it; move it aside and retry")
         else:
             data = {}
 

codecortex-0.14.0/src/codeintel/policy.py

@@ -0,0 +1,93 @@
+from __future__ import annotations
+
+import os
+
+_ALL = "*"
+
+
+def _normalize_root(path: str) -> str:
+    """An absolute, symlink-resolved root for containment comparison. Resolving BOTH sides is what
+    makes `..` traversal and symlink escapes ineffective: `/srv/a/../../etc` normalizes to `/etc`
+    and simply fails the prefix test."""
+    try:
+        return os.path.realpath(path).rstrip(os.sep) or os.sep
+    except Exception:
+        return ""
+
+
+class TieringPolicy:
+    """Role access policy — disabled by default (everything allowed).
+
+    Two independent dimensions, and they are NOT interchangeable:
+
+    * **ops** (*rules*) — which operations a role may call. A role absent from *rules* is
+      unrestricted, which is why an op allowlist alone is fail-open by design.
+    * **roots** — which project directories a role may point those operations AT. This one fails
+      CLOSED: a role with no roots declared may target nothing.
+
+    The asymmetry is deliberate. `project_root` arrives in the request body, so without a root
+    allowlist any role that can call `search` can direct the server to walk, index, and return the
+    contents of any directory the server process can read — the op allowlist never sees it. Scoping
+    operations while leaving the target unbounded is not a partial restriction; it is none.
+
+    Immutable after construction; safe to share across threads.
+    """
+
+    def __init__(
+        self,
+        enabled: bool = False,
+        rules: dict[str, list[str]] | None = None,
+        roots: dict[str, list[str]] | None = None,
+    ) -> None:
+        self._enabled = enabled
+        self._rules: dict[str, list[str]] = (
+            {role: list(ops) for role, ops in rules.items()} if rules else {}
+        )
+        self._roots: dict[str, list[str]] = {}
+        for role, paths in (roots or {}).items():
+            if _ALL in paths:
+                self._roots[role] = [_ALL]
+            else:
+                # Drop blanks BEFORE normalizing. `_normalize_root("")` is the process cwd, not
+                # "", so a stray empty string or trailing-comma artifact in an operator's roots
+                # list silently added "wherever the server was launched" to the allowlist — the
+                # one fail-OPEN case in an otherwise fail-closed model.
+                self._roots[role] = [
+                    r for r in (_normalize_root(str(p)) for p in paths if str(p).strip()) if r
+                ]
+
+    def is_allowed(self, role: str, op: str) -> bool:
+        if not self._enabled:
+            return True
+        allowed_ops = self._rules.get(role)
+        if allowed_ops is None:
+            return True
+        return op in allowed_ops
+
+    def is_root_allowed(self, role: str, project_root: str) -> bool:
+        """May *role* target *project_root*? Fails closed when RBAC is on.
+
+        Containment is computed on realpaths of both sides, so `..` segments and a symlinked
+        project_root cannot walk out of an allowed root. A blank project_root is rejected before
+        resolution, because realpath("") is the server's cwd rather than an error.
+
+        NOTE the boundary this does and does not draw: it bounds which root a caller may NAME. It
+        does not bound what the indexer reads once inside — that containment lives in
+        ``Indexer._walk_files``, which must skip symlinks escaping the tree, or a tenant who can
+        write into their own root defeats this by planting one."""
+        if not self._enabled:
+            return True
+        allowed = self._roots.get(role)
+        if not allowed:                      # undeclared or explicitly empty → nothing permitted
+            return False
+        if _ALL in allowed:
+            return True
+        # Reject blank BEFORE resolving. `os.path.realpath("")` returns the process's cwd, so a
+        # missing project_root silently became "wherever the server was launched" — and passed
+        # whenever that happened to sit under an allowed root. The docstring claimed otherwise.
+        if not project_root or not project_root.strip():
+            return False
+        target = _normalize_root(project_root)
+        if not target:
+            return False
+        return any(target == root or target.startswith(root + os.sep) for root in allowed)