codecortex 0.13.1__tar.gz → 0.14.2__tar.gz

{codecortex-0.13.1/src/codecortex.egg-info → codecortex-0.14.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.13.1
+Version: 0.14.2
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -296,6 +296,12 @@ codeintel index /path/to/repo
 The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
 rather than a bare reason.
 
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation
@@ -433,6 +439,23 @@ docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \
   -e CODEINTEL_HTTP_TOKEN="$(openssl rand -hex 32)" codeintel
 ```
 
+## Reporting a problem
+
+`codeintel doctor --json` prints a complete, machine-readable picture of what's installed, what's
+runnable, and whether this repo is indexed — per engine, with the remediation for each gap. Paste
+it into an issue and the report is actionable immediately instead of needing a round trip:
+
+```bash
+codeintel doctor --json
+```
+
+It reports only local engine and index state. Over the HTTP transport the `registrations` field —
+which names agent config files on the machine running the server — is deliberately omitted.
+
+If a *result* looks wrong rather than a command failing, include the exact `code.query` call and
+its full envelope. `reason`, `hint`, `engine`, `cached`, and `reindexing` between them explain
+which engine answered and how current its index was, which is usually the whole diagnosis.
+
 ## Development
 
 ```bash

{codecortex-0.13.1 → codecortex-0.14.2}/README.md

@@ -259,6 +259,12 @@ codeintel index /path/to/repo
 The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
 rather than a bare reason.
 
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation
@@ -396,6 +402,23 @@ docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \
   -e CODEINTEL_HTTP_TOKEN="$(openssl rand -hex 32)" codeintel
 ```
 
+## Reporting a problem
+
+`codeintel doctor --json` prints a complete, machine-readable picture of what's installed, what's
+runnable, and whether this repo is indexed — per engine, with the remediation for each gap. Paste
+it into an issue and the report is actionable immediately instead of needing a round trip:
+
+```bash
+codeintel doctor --json
+```
+
+It reports only local engine and index state. Over the HTTP transport the `registrations` field —
+which names agent config files on the machine running the server — is deliberately omitted.
+
+If a *result* looks wrong rather than a command failing, include the exact `code.query` call and
+its full envelope. `reason`, `hint`, `engine`, `cached`, and `reindexing` between them explain
+which engine answered and how current its index was, which is usually the whole diagnosis.
+
 ## Development
 
 ```bash

{codecortex-0.13.1 → codecortex-0.14.2/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.13.1
+Version: 0.14.2
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -296,6 +296,12 @@ codeintel index /path/to/repo
 The reply names the fix when it can: a missing symbol now returns a `hint` with the exact command
 rather than a bare reason.
 
+One more honest caveat. For targets that are **symbol names or free text** (most of them —
+`callers`, `impact`, `hotspots`, `search`), there is no file whose content hash could change, so a
+cached answer is invalidated only when a background reindex completes, and those are debounced
+(~30s). An edit followed immediately by the same query can therefore return the pre-edit answer.
+Targets that are real file paths are content-hashed and refresh as soon as the bytes change.
+
 Pass `--engine auto` (the default) and codeintel chooses the best engine per operation. Pass `--engine both` or `--engine all` to fan out to multiple engines and merge results.
 
 ## Documentation
@@ -433,6 +439,23 @@ docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \
   -e CODEINTEL_HTTP_TOKEN="$(openssl rand -hex 32)" codeintel
 ```
 
+## Reporting a problem
+
+`codeintel doctor --json` prints a complete, machine-readable picture of what's installed, what's
+runnable, and whether this repo is indexed — per engine, with the remediation for each gap. Paste
+it into an issue and the report is actionable immediately instead of needing a round trip:
+
+```bash
+codeintel doctor --json
+```
+
+It reports only local engine and index state. Over the HTTP transport the `registrations` field —
+which names agent config files on the machine running the server — is deliberately omitted.
+
+If a *result* looks wrong rather than a command failing, include the exact `code.query` call and
+its full envelope. `reason`, `hint`, `engine`, `cached`, and `reindexing` between them explain
+which engine answered and how current its index was, which is usually the whole diagnosis.
+
 ## Development
 
 ```bash

codecortex-0.14.2/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.14.2"

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/auth.py

@@ -38,9 +38,11 @@ class TokenAuth:
     """Resolves a bearer token to a role and builds the matching op policy. Tokens are held as
     sha256 hashes; a presented token is hashed and looked up in O(1). Immutable; thread-safe."""
 
-    def __init__(self, token_hash_to_role: dict[str, str], role_ops: dict[str, list[str]]) -> None:
+    def __init__(self, token_hash_to_role: dict[str, str], role_ops: dict[str, list[str]],
+                 role_roots: dict[str, list[str]] | None = None) -> None:
         self._tokens = token_hash_to_role
         self._role_ops = role_ops
+        self._role_roots = role_roots or {}
 
     @property
     def enabled(self) -> bool:
@@ -56,13 +58,19 @@ class TokenAuth:
     def build_policy(self) -> TieringPolicy:
         """A role with ops ``["*"]`` (or none) is unrestricted → omit it from the rules, since
         TieringPolicy treats a role absent from its rules as full-access. Every other role maps to
-        its explicit op allowlist (an empty list = deny all ops, a fail-safe default)."""
+        its explicit op allowlist (an empty list = deny all ops, a fail-safe default).
+
+        ``enabled`` is True whenever RBAC is configured at all — NOT merely when some role has a
+        restricted op list. It used to be ``bool(rules)``, which meant a config whose roles were
+        all ``["*"]`` produced a disabled policy, and a disabled policy enforces no root scoping
+        either. Op behavior is unchanged (a role absent from rules is still unrestricted); this
+        only ensures the root allowlist is actually consulted."""
         rules: dict[str, list[str]] = {}
         for role, ops in self._role_ops.items():
             if _ALL in ops:
                 continue  # unrestricted
             rules[role] = list(ops)
-        return TieringPolicy(enabled=bool(rules), rules=rules)
+        return TieringPolicy(enabled=True, rules=rules, roots=dict(self._role_roots))
 
 
 def _auth_config_path() -> pathlib.Path | None:
@@ -99,6 +107,19 @@ def load_auth() -> TokenAuth:
             logger.warning("auth: role %r ops must be a list (got %r) — denying all ops for it", role, ops)
             role_ops[str(role)] = []
 
+    roots_section = data.get("roots")
+    raw_roots: dict = roots_section if isinstance(roots_section, dict) else {}
+    role_roots: dict[str, list[str]] = {}
+    for role, paths in raw_roots.items():
+        if isinstance(paths, list):
+            role_roots[str(role)] = [str(r) for r in paths]
+        else:
+            # Same fail-CLOSED rule as ops: a bare string (`reader = "/srv/repo"`) is a typo, and
+            # guessing it meant a one-element list would hand out access the operator never wrote.
+            logger.warning("auth: role %r roots must be a list (got %r) — denying all paths for it",
+                           role, paths)
+            role_roots[str(role)] = []
+
     tokens_section = data.get("tokens")
     raw_tokens: dict = tokens_section if isinstance(tokens_section, dict) else {}
     token_hash_to_role: dict[str, str] = {}
@@ -107,6 +128,7 @@ def load_auth() -> TokenAuth:
         # A token mapped to an undefined role fails safe: define it as deny-all (empty op list).
         if role not in role_ops:
             role_ops[role] = []
+        role_roots.setdefault(role, [])
         tok = str(tok)
         if tok[:len(_SHA_PREFIX)].lower() == _SHA_PREFIX:  # case-insensitive `sha256:` prefix
             h = tok[len(_SHA_PREFIX):].strip().lower()
@@ -118,4 +140,13 @@ def load_auth() -> TokenAuth:
     if not token_hash_to_role:
         logger.warning("auth: %s defines no usable [tokens] — RBAC is OFF (no token→role mapping)", path)
 
-    return TokenAuth(token_hash_to_role, role_ops)
+    # A configured-but-unscoped RBAC deployment is the exact shape of the hole this closes, so say
+    # so at load time rather than letting the operator discover it as a wall of 403s.
+    unscoped = sorted(r for r in role_ops if not role_roots.get(r))
+    if token_hash_to_role and unscoped:
+        logger.warning(
+            "auth: roles %s have no [roots] entry and may target NO project — add a [roots] table "
+            "(e.g. `%s = [\"/srv/repos/team-a\"]`, or `= [\"*\"]` for unrestricted)",
+            ", ".join(unscoped), unscoped[0])
+
+    return TokenAuth(token_hash_to_role, role_ops, role_roots)

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/cache.py

@@ -9,9 +9,20 @@ from codeintel.provider import Result
 
 
 def _compute_hash(target: str, project_root: str) -> str:
+    """The cache key's content component: a file target hashes its BYTES, so an edit invalidates.
+
+    A relative target must be resolved against ``project_root``, not the process cwd. It used to
+    use ``os.path.realpath(target)`` alone — and the ops whose target is a path take it
+    repo-relative (`overview` passes it straight through as serena's ``relative_path``). The
+    server is a long-lived singleton answering for whichever ``project_root`` a caller names, so
+    its cwd matches at most one repo and usually none: `inside_root` was false, and every such
+    entry silently fell back to hashing the *string*, which never changes when the file does.
+    That is exactly the "an edit forces a refresh" guarantee docs/architecture.md advertises."""
     try:
         root = os.path.realpath(project_root) if project_root else ""
-        path = os.path.realpath(target)
+        # Relative targets resolve inside the project; absolute ones are already anchored.
+        raw = target if os.path.isabs(target) or not root else os.path.join(root, target)
+        path = os.path.realpath(raw)
         inside_root = (root and path.startswith(root + os.sep)) or path == root
         if inside_root and os.path.isfile(path):
             with open(path, "rb") as fh:

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/commands/_common.py

@@ -18,6 +18,17 @@ def resolve_root(args: Any) -> str:
     return getattr(args, "project_root", None) or os.getcwd()
 
 
+def require_dir(project_root: str, command: str) -> str | None:
+    """An error line when *project_root* is not a directory, else None.
+
+    A mistyped path used to produce confident, well-formed output about a directory that does not
+    exist — `setup /typo` rendered a full three-engine health table for it — which is the worst
+    possible response to a typo in a script, because it is indistinguishable from success."""
+    if os.path.isdir(project_root):
+        return None
+    return f"{command} failed: not a directory: {project_root}"
+
+
 def emit(report: dict, *, as_json: bool, render: Callable[[dict], str]) -> None:
     """Print a report as structured JSON (--json) or as its human-facing text rendering."""
     if as_json:

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/commands/graph.py

@@ -3,14 +3,21 @@
 import json
 from typing import Any
 
-from codeintel.commands._common import never_raise, resolve_root
+from codeintel.commands._common import never_raise, require_dir, resolve_root
 
 
-@never_raise("graph failed: {exc}")
+# code=1: this command's job is to WRITE A FILE. Exiting 0 after failing to write it
+# reports success to any `make`/CI step gating on $? while nothing was produced.
+@never_raise("graph failed: {exc}", code=1)
 def run(args: Any) -> int:
     from codeintel import grapher
 
-    payload = grapher.build_graph_payload(resolve_root(args), limit=args.limit)
+    project_root = resolve_root(args)
+    problem = require_dir(project_root, "graph")
+    if problem:
+        print(problem)
+        return 1
+    payload = grapher.build_graph_payload(project_root, limit=args.limit)
     nodes, edges = len(payload.get("nodes", [])), len(payload.get("edges", []))
 
     if not args.html:

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/commands/index.py

@@ -12,6 +12,13 @@ def run(args: Any) -> int:
     from codeintel.semantic_db import SemanticDb, default_db_path
 
     project_root = resolve_root(args)
+    # Validate before doing anything. `codeintel index /typo/path` walked nothing, found nothing,
+    # and printed "Nothing new to index" at exit 0 — indistinguishable from a correct incremental
+    # run, which is the worst possible response to a mistyped path in a script.
+    if not os.path.isdir(project_root):
+        print(f"index failed: not a directory: {project_root}")
+        return 1
+    failed = False
     # Wrap the whole semantic pass so a setup failure (e.g. an unresolvable home dir →
     # Path.home() raising) degrades with a message, like every other subcommand, not a traceback.
     try:
@@ -32,12 +39,18 @@ def run(args: Any) -> int:
             ).index(project_root)
             if count > 0:
                 print(f"Indexed {count} chunks")
+            elif count < 0:
+                # Indexer.index() returns -1 for an unrecoverable failure. `> 0` sent that into
+                # the "Nothing new to index" branch, so a total failure read as a clean no-op.
+                print("index failed — the indexer could not complete (see the warnings above)")
+                failed = True
             else:
                 print("Nothing new to index")
         finally:
             db.close()
     except Exception as exc:
         print(f"index failed: {exc}")
+        failed = True
 
     # best-effort graph reindex
     import shutil
@@ -60,4 +73,4 @@ def run(args: Any) -> int:
     except Exception:
         pass
 
-    return 0
+    return 1 if failed else 0

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/commands/map.py

@@ -2,17 +2,23 @@
 
 from typing import Any
 
-from codeintel.commands._common import never_raise, resolve_root
+from codeintel.commands._common import never_raise, require_dir, resolve_root
 
 
 # Never-raise parity with the MCP code.map handler — degrade, don't crash.
-@never_raise("map failed: {exc}")
+# code=1: this command's job is to WRITE A FILE. Exiting 0 after failing to write it
+# reports success to any `make`/CI step gating on $? while nothing was produced.
+@never_raise("map failed: {exc}", code=1)
 def run(args: Any) -> int:
     from codeintel.injector import Injector
     from codeintel.mapper import MapGenerator
     from codeintel.providers.graph import GraphProvider
 
     project_root = resolve_root(args)
+    problem = require_dir(project_root, "map")
+    if problem:
+        print(problem)
+        return 1
     try:
         provider = GraphProvider()
     except Exception:

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/commands/setup.py

@@ -2,16 +2,21 @@
 
 from typing import Any
 
-from codeintel.commands._common import emit, never_raise, resolve_root
+from codeintel.commands._common import emit, never_raise, require_dir, resolve_root
 
 
 @never_raise("setup unavailable: {exc}")
 def run(args: Any) -> int:
     from codeintel import onboarding
 
+    project_root = resolve_root(args)
+    problem = require_dir(project_root, "setup")
+    if problem:
+        print(problem)
+        return 1
     all_steps = getattr(args, "all_steps", False)  # --all implies every automatable step
     report = onboarding.run_setup(
-        resolve_root(args),
+        project_root,
         install_uv=args.install_uv or all_steps,
         install_deps=args.install_deps or all_steps,
         do_index=args.index or all_steps,

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/commands/status.py

@@ -4,7 +4,7 @@ import datetime
 import os
 from typing import Any
 
-from codeintel.commands._common import never_raise, resolve_root
+from codeintel.commands._common import never_raise, require_dir, resolve_root
 
 # "available" alone was the misleading word: it meant "a binary is on PATH", which is not the same
 # as runnable, and not the same as usable on THIS repo. Say which.
@@ -16,6 +16,10 @@ def run(args: Any) -> int:
     from codeintel import server
 
     project_root = resolve_root(args)
+    problem = require_dir(project_root, "status")
+    if problem:
+        print(problem)
+        return 1
     status = server.code_status_handler({"project_root": project_root})
 
     readiness = status.get("readiness") or {}

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/gateway.py

@@ -40,6 +40,15 @@ _UNCACHED_OPS: frozenset[str] = frozenset({"changed", "changes"})
 _ADOPTABLE_ENGINES: frozenset[str] = frozenset({"graph", "lsp", "semantic"})
 
 
+def _mark_reindexing(result: Result, reindexing: bool) -> Result:
+    """Flag an answer served while a reindex for its project is still running."""
+    if not reindexing or result.get("result") is None:
+        return result
+    return {**result, "reindexing": True,
+            "hint": "a reindex is in progress — this answer reflects the index as of the last "
+                    "completed pass; re-ask shortly if you have just changed this code"}
+
+
 class Gateway:
     def __init__(self, graph=None, lsp=None, semantic=None, policy: TieringPolicy | None = None,
                  reindexer: Reindexer | None = None):
@@ -191,6 +200,15 @@ class Gateway:
         except Exception:
             return True
 
+    def allows_root(self, role: str, project_root: str) -> bool:
+        """Whether *role* may target *project_root*. The companion to ``allows`` — an op gate alone
+        leaves the TARGET unbounded, which is how `doctor` and `status` could still be pointed at
+        any readable directory after `query` had been scoped."""
+        try:
+            return self._policy is None or self._policy.is_root_allowed(role, project_root)
+        except Exception:
+            return True
+
     def query(
         self,
         op=None,
@@ -206,20 +224,37 @@ class Gateway:
             engine_str = str(engine or "").strip() or "auto"
             was_auto = engine_str == "auto"
 
-            # Policy check FIRST — a role denied for this op does NO work (no reindex, no dispatch,
-            # no cache lookup). Applies to the modern provider path; the legacy list path has none.
-            if (
-                self._legacy_providers is None
-                and self._policy is not None
-                and not self._policy.is_allowed(role, op_str)
-            ):
-                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+            # Policy check FIRST — a role denied here does NO work (no reindex, no dispatch, no
+            # cache lookup, and critically no on-demand indexing walk). Applies to the modern
+            # provider path; the legacy list path has none.
+            if self._legacy_providers is None and self._policy is not None:
+                if not self._policy.is_allowed(role, op_str):
+                    return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+                # `project_root` arrives in the request body. Without this check any role able to
+                # call `search` could name ANY directory the server process can read, and the
+                # semantic provider would walk, index, and return its contents — an op allowlist
+                # never sees the target. Denied before maybe_reindex, so a rejected path is not
+                # even touched.
+                if not self._policy.is_root_allowed(role, str(project_root or "")):
+                    return safe_null_result(op_str, target_str, reason="root-not-allowed-for-role",
+                                            hint="this token's role is not scoped to that "
+                                                 "project_root (see the [roots] table in auth.toml)")
 
             try:
                 self._reindexer.maybe_reindex(str(project_root or ""))
             except Exception:
                 pass
 
+            # If a reindex is running, this answer comes from the PREVIOUS index. Structural
+            # answers (callers/impact/hotspots) hash a symbol name, not file bytes, so nothing
+            # else in the envelope can reveal that — and an agent that just edited and asked
+            # "what did I break?" lands precisely here. Busting the cache would not help: the
+            # index itself is behind, so re-asking refetches the same stale data.
+            try:
+                reindexing = self._reindexer.reindex_pending(str(project_root or ""))
+            except Exception:
+                reindexing = False
+
             # Legacy list-based path (backward compat with pre-Phase-2 tests)
             if self._legacy_providers is not None:
                 for p in self._legacy_providers:
@@ -240,6 +275,15 @@ class Gateway:
             if engine_str == "auto":
                 engine_str = _AUTO_ENGINE.get(op_str, "graph")
 
+            # Cache under what was ASKED, not what auto resolved to. `auto` and an explicit
+            # `graph` both resolved to "graph" and so shared one key — but they are different
+            # questions: `auto` accepts the overview LSP fallback below, an explicit `graph`
+            # does not. One `auto` miss therefore parked an LSP answer under the graph key, and
+            # the next explicit `engine=graph` request got it back with `cached: true` and an
+            # `engine: "lsp"` field contradicting its own request. Reachable on any cold start,
+            # since "graph not indexed yet" is the normal first-query state.
+            cache_engine = "auto" if was_auto else engine_str
+
             root_str = project_root or ""
 
             # Freshness token — bumps when a background reindex completes, so a cached
@@ -259,7 +303,7 @@ class Gateway:
             if engine_str in _FANOUT_ENGINES:
                 cached_result = (
                     None if uncacheable
-                    else self._cache.get(op_str, target_str, engine_str, root_str, freshness)
+                    else self._cache.get(op_str, target_str, cache_engine, root_str, freshness)
                 )
                 if cached_result is not None:
                     return {**cached_result, "cached": True}
@@ -268,13 +312,13 @@ class Gateway:
                 fan_results = self._fan_out(engines, op_str, target_str, budget, project_root)
                 result = self._merge(fan_results, op_str, target_str, engine_str)
                 if not uncacheable:
-                    self._cache.put(op_str, target_str, engine_str, root_str, result, freshness)
+                    self._cache.put(op_str, target_str, cache_engine, root_str, result, freshness)
                 return result
 
             # Single-engine dispatch (`uncacheable`, computed above, also guards this path).
             cached_result = (
                 None if uncacheable
-                else self._cache.get(op_str, target_str, engine_str, root_str, freshness)
+                else self._cache.get(op_str, target_str, cache_engine, root_str, freshness)
             )
             if cached_result is not None:
                 return {**cached_result, "cached": True}
@@ -298,8 +342,8 @@ class Gateway:
                     result = lsp_result
 
             if not uncacheable:
-                self._cache.put(op_str, target_str, engine_str, root_str, result, freshness)
-            return result
+                self._cache.put(op_str, target_str, cache_engine, root_str, result, freshness)
+            return _mark_reindexing(result, reindexing)
 
         except Exception as exc:
             log_swallowed("Gateway.query", exc)

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/http_server.py

@@ -168,8 +168,10 @@ class _Handler(BaseHTTPRequestHandler):
             return
 
         # Everything else is auth-gated when auth is configured (metrics can reveal usage patterns;
-        # status reveals engine/index state). Any valid token/role may read these operational views.
-        ok, _ = self._resolve_role()
+        # status reveals engine/index state). The role is kept, not discarded: /code/status takes a
+        # project_root, and answering it for any path regardless of the role's [roots] was the same
+        # cross-tenant disclosure that scoping /code/query was meant to close.
+        ok, role = self._resolve_role()
         if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
@@ -185,7 +187,9 @@ class _Handler(BaseHTTPRequestHandler):
             return
         if path == "/code/status":
             project_root = (parse_qs(parsed.query).get("project_root") or [""])[0]
-            self._send_json(200, code_status_handler({"project_root": project_root}))
+            # role is server-authoritative, exactly as on the POST path — never read from input.
+            self._send_json(200, code_status_handler(
+                {"project_root": project_root, "role": role}))
             return
         self._send_json(404, {"error": "not-found"})
 

{codecortex-0.13.1 → codecortex-0.14.2}/src/codeintel/indexer.py

@@ -13,6 +13,15 @@ if TYPE_CHECKING:
 
 logger = logging.getLogger(__name__)
 
+# Hard ceiling on the characters embedded for ONE chunk. Line-based splitting cannot bound a
+# minified or generated single-line file, and the embedder's memory use scales with input size.
+# Generous enough that no hand-written function is affected.
+_MAX_CHUNK_CHARS = 200_000
+
+# Bytes examined when deciding whether a file is binary. A NUL in the first block is the classic
+# signal and is what `git` itself uses.
+_BINARY_SNIFF_BYTES = 8192
+
 _INDEXED_EXTS = frozenset({
     ".py", ".md",
     ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",       # TS/JS variants
@@ -103,6 +112,15 @@ def _ts_decl_is_function(node) -> bool:
     return False
 
 
+def _looks_binary(path) -> bool:
+    """Whether *path* is binary, by the same rule git uses: a NUL byte in the opening block."""
+    try:
+        with open(path, "rb") as fh:
+            return b"\x00" in fh.read(_BINARY_SNIFF_BYTES)
+    except OSError:
+        return True                        # unreadable → treat as unindexable rather than crash
+
+
 class Indexer:
     def __init__(
         self,
@@ -205,8 +223,26 @@ class Indexer:
         except Exception as exc:
             logger.warning("Cleanup pass failed: %s", exc)
 
+    @staticmethod
+    def _binary_check(path) -> bool:
+        return _looks_binary(path)
+
     def _walk_files(self, root: Path):
+        """Indexable files inside *root* — and strictly inside it.
+
+        ``os.walk`` defaults to ``followlinks=False``, which stops recursion into symlinked
+        DIRECTORIES but says nothing about symlinked FILES: those still appear in ``filenames``,
+        and the later ``open()`` follows them transparently. That made a planted symlink a
+        complete bypass of RBAC project scoping — a tenant able to write inside their own allowed
+        root could link to any file the server process can read and have it indexed, embedded, and
+        returned as a search snippet. Demonstrated before this guard existed.
+
+        So every candidate is resolved and required to land back under the resolved root."""
         ignores = set(_SKIP_DIRS) | set(_DEFAULT_IGNORES) | self._load_gitignore(root)
+        try:
+            real_root = os.path.realpath(root)
+        except Exception:
+            real_root = str(root)
         for dirpath, dirnames, filenames in os.walk(root):
             dirnames[:] = [
                 d for d in dirnames
@@ -215,8 +251,39 @@ class Indexer:
             for fname in filenames:
                 if fname in ignores:
                     continue
-                if Path(fname).suffix.lower() in _INDEXED_EXTS:
-                    yield Path(dirpath) / fname
+                if Path(fname).suffix.lower() not in _INDEXED_EXTS:
+                    continue
+                candidate = Path(dirpath) / fname
+                try:
+                    real = os.path.realpath(candidate)
+                except Exception:
+                    continue
+                if real != real_root and not real.startswith(real_root + os.sep):
+                    logger.warning("skipping %s — it resolves outside the indexed root", candidate)
+                    continue
+                # A HARDLINK is a second directory entry for the same inode. It is physically
+                # inside the root, so its realpath is inside the root and the check above passes
+                # — `realpath` cannot see it. That reopened exactly the hole the symlink guard
+                # closes: a tenant able to write in their own root could `ln` another tenant's
+                # file in and have it indexed. There is no way to ask "does this inode also live
+                # outside?", so treat extra links as disqualifying. Measured at 0 occurrences
+                # across 3213 source files of a real repo, so the false-positive cost is nil.
+                try:
+                    links = os.stat(real).st_nlink
+                except OSError:
+                    continue
+                if links > 1:
+                    logger.warning("skipping %s — %d hard links, so its content may also live "
+                                   "outside the indexed root", candidate, links)
+                    continue
+                # A source extension is not a promise of source. A compiled artifact or blob named
+                # `.py` was read with errors="replace" and embedded as replacement-character
+                # garbage — 196KB of /dev/urandom produced 162 chunks — which then competed for
+                # rank against real code in every search.
+                if _looks_binary(candidate):
+                    logger.warning("skipping %s — looks binary despite its extension", candidate)
+                    continue
+                yield candidate
 
     # ---- chunk-span computation ------------------------------------------------------------
     # A file is turned into a list of 0-based, half-open ``(start, end)`` line spans; every
@@ -451,6 +518,17 @@ class Indexer:
             if not chunk_lines:
                 continue
             chunk_text = "".join(chunk_lines)
+            # Cap chunk BYTES, not just lines. `_maybe_split` splits on line boundaries, so a
+            # minified bundle or a generated one-liner is a single unsplittable chunk however
+            # large: a 20MB one-line .py peaked at 3.4GB RSS through the embedder, and a 40MB
+            # one extrapolates past 8GB. That runs on the reindexer's daemon thread inside the
+            # long-lived MCP server, so it can take the agent host down, not just a CLI run.
+            # Truncation is the right trade — the head of a chunk carries its identifying
+            # content, and an over-long minified line has no retrieval value past that anyway.
+            if len(chunk_text) > _MAX_CHUNK_CHARS:
+                logger.warning("truncating an oversized chunk in %s (%d chars) to %d",
+                               rel_path, len(chunk_text), _MAX_CHUNK_CHARS)
+                chunk_text = chunk_text[:_MAX_CHUNK_CHARS]
             if not chunk_text.strip():
                 # EC3.4: never embed empty/whitespace-only chunks (zero vectors pollute results).
                 chunk_count += 1