codecortex 0.16.0__tar.gz → 0.18.0__tar.gz

{codecortex-0.16.0/src/codecortex.egg-info → codecortex-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.16.0
+Version: 0.18.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -279,7 +279,7 @@ Then it launches the exact command it registered and drives a real MCP handshake
 ```text
 v claude: registered at /Users/you/.claude.json
 
-v verified: codeintel 0.11.2 — 4 tools (code.query, code.status, code.doctor, code.map)
+v verified: codeintel 0.18.0 — 4 tools (code.query, code.status, code.doctor, code.map)
 ```
 
 If the command is not on `PATH`, or the server fails to start, install says so and exits non-zero
@@ -396,7 +396,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel install [--agent auto\|claude\|codex\|gemini\|zed\|all] [--no-verify] [--relative-command]` | Register codeintel with the agents installed on this machine (`auto`, the default), then prove it by completing a real MCP handshake against the registered command |
 | `codeintel setup [project_root] [--all] [--index] [--warm] [--install-uv] [--install-deps] [--json]` | Prepare backends + index this repo (`--all` = one command: do everything automatable, idempotent); ends with a health report + **Next:** steps |
 | `codeintel prompt [project_root] [--agent auto\|claude\|codex\|gemini\|zed] [--fresh] [--deep]` | Print a paste-to-your-agent setup prompt; probes health and emits only the outstanding steps (or "just restart me" when already healthy). `--fresh` = the full sequence from `pip install`, to send a friend |
-| `codeintel index [project_root]` | Index a project for semantic search |
+| `codeintel index [project_root] [--quiet]` | Index a repo (semantic embeddings + best-effort graph & map refresh), with a live progress display; `--quiet` prints only the result line |
 | `codeintel serve` | Start the MCP server (stdio transport) |
 | `codeintel serve-http [--host HOST] [--port 8766] [--allow-remote] [--token TOKEN]` | Start the HTTP transport (loopback-only unless `--allow-remote`; `--token` requires a bearer token on every request) |
 | `codeintel query --op OP --target TARGET [--engine auto] [--project-root DIR] [--json]` | Run a single query and print the result |
@@ -404,10 +404,10 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel graph [project_root] [--html] [--out FILE] [--limit N]` | Emit the call graph as `{nodes,edges}` JSON, or `--html` a self-contained interactive viewer — see [docs/graph-viewer.md](docs/graph-viewer.md) |
-| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear this repo's index — **both** semantic and graph — so it's as if never indexed; `--all` wipes every repo. Recovers from a corrupt/stale DB |
 | `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
-Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
+Human-facing commands (`doctor`, `setup`, `prompt`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
 **Exit codes**, so a `make` target or CI step can gate on `$?`:
 
@@ -444,7 +444,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
 | `CODEINTEL_DEBUG=1` | Log the full traceback of any error the never-throw contract swallows (silent by default) — the switch for diagnosing an unexpected `null` |
 | `CODEINTEL_REINDEX=off` | Disable the background reindexer; queries then index inline to stay fresh |
-| `CODEINTEL_HOME` | Where the index cache lives (default `~/.codeintel`). Set this when the process has **no resolvable home directory** — a container running as a UID with no passwd entry and no `$HOME`, which is common when an agent runs in one. Without it, `Path.home()` raises and every command fails somewhere far from the cause. |
+| `CODEINTEL_HOME` | Where per-machine state lives (default `~/.codeintel`) — the index cache, the global `config.toml`, and `auth.toml`. Set this when the process has **no resolvable home directory** — a container running as a UID with no passwd entry and no `$HOME`, which is common when an agent runs in one. Without it, `Path.home()` raises and every command fails somewhere far from the cause. |
 
 ## Privacy & dependencies
 
@@ -617,7 +617,7 @@ git clone https://github.com/hamilton-sky/codeintel.git
 cd codeintel
 pip install -e .[dev]
 
-pytest tests/ -q            # ~620 tests, ~30s; fails under 83% coverage
+pytest tests/ -q            # ~740 tests, ~30s; fails under 83% coverage
 ruff check src tests        # lint
 mypy                        # types (src/ only)
 ```

{codecortex-0.16.0 → codecortex-0.18.0}/README.md

@@ -242,7 +242,7 @@ Then it launches the exact command it registered and drives a real MCP handshake
 ```text
 v claude: registered at /Users/you/.claude.json
 
-v verified: codeintel 0.11.2 — 4 tools (code.query, code.status, code.doctor, code.map)
+v verified: codeintel 0.18.0 — 4 tools (code.query, code.status, code.doctor, code.map)
 ```
 
 If the command is not on `PATH`, or the server fails to start, install says so and exits non-zero
@@ -359,7 +359,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel install [--agent auto\|claude\|codex\|gemini\|zed\|all] [--no-verify] [--relative-command]` | Register codeintel with the agents installed on this machine (`auto`, the default), then prove it by completing a real MCP handshake against the registered command |
 | `codeintel setup [project_root] [--all] [--index] [--warm] [--install-uv] [--install-deps] [--json]` | Prepare backends + index this repo (`--all` = one command: do everything automatable, idempotent); ends with a health report + **Next:** steps |
 | `codeintel prompt [project_root] [--agent auto\|claude\|codex\|gemini\|zed] [--fresh] [--deep]` | Print a paste-to-your-agent setup prompt; probes health and emits only the outstanding steps (or "just restart me" when already healthy). `--fresh` = the full sequence from `pip install`, to send a friend |
-| `codeintel index [project_root]` | Index a project for semantic search |
+| `codeintel index [project_root] [--quiet]` | Index a repo (semantic embeddings + best-effort graph & map refresh), with a live progress display; `--quiet` prints only the result line |
 | `codeintel serve` | Start the MCP server (stdio transport) |
 | `codeintel serve-http [--host HOST] [--port 8766] [--allow-remote] [--token TOKEN]` | Start the HTTP transport (loopback-only unless `--allow-remote`; `--token` requires a bearer token on every request) |
 | `codeintel query --op OP --target TARGET [--engine auto] [--project-root DIR] [--json]` | Run a single query and print the result |
@@ -367,10 +367,10 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel graph [project_root] [--html] [--out FILE] [--limit N]` | Emit the call graph as `{nodes,edges}` JSON, or `--html` a self-contained interactive viewer — see [docs/graph-viewer.md](docs/graph-viewer.md) |
-| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear this repo's index — **both** semantic and graph — so it's as if never indexed; `--all` wipes every repo. Recovers from a corrupt/stale DB |
 | `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
-Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
+Human-facing commands (`doctor`, `setup`, `prompt`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
 **Exit codes**, so a `make` target or CI step can gate on `$?`:
 
@@ -407,7 +407,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
 | `CODEINTEL_DEBUG=1` | Log the full traceback of any error the never-throw contract swallows (silent by default) — the switch for diagnosing an unexpected `null` |
 | `CODEINTEL_REINDEX=off` | Disable the background reindexer; queries then index inline to stay fresh |
-| `CODEINTEL_HOME` | Where the index cache lives (default `~/.codeintel`). Set this when the process has **no resolvable home directory** — a container running as a UID with no passwd entry and no `$HOME`, which is common when an agent runs in one. Without it, `Path.home()` raises and every command fails somewhere far from the cause. |
+| `CODEINTEL_HOME` | Where per-machine state lives (default `~/.codeintel`) — the index cache, the global `config.toml`, and `auth.toml`. Set this when the process has **no resolvable home directory** — a container running as a UID with no passwd entry and no `$HOME`, which is common when an agent runs in one. Without it, `Path.home()` raises and every command fails somewhere far from the cause. |
 
 ## Privacy & dependencies
 
@@ -580,7 +580,7 @@ git clone https://github.com/hamilton-sky/codeintel.git
 cd codeintel
 pip install -e .[dev]
 
-pytest tests/ -q            # ~620 tests, ~30s; fails under 83% coverage
+pytest tests/ -q            # ~740 tests, ~30s; fails under 83% coverage
 ruff check src tests        # lint
 mypy                        # types (src/ only)
 ```

{codecortex-0.16.0 → codecortex-0.18.0/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.16.0
+Version: 0.18.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -279,7 +279,7 @@ Then it launches the exact command it registered and drives a real MCP handshake
 ```text
 v claude: registered at /Users/you/.claude.json
 
-v verified: codeintel 0.11.2 — 4 tools (code.query, code.status, code.doctor, code.map)
+v verified: codeintel 0.18.0 — 4 tools (code.query, code.status, code.doctor, code.map)
 ```
 
 If the command is not on `PATH`, or the server fails to start, install says so and exits non-zero
@@ -396,7 +396,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel install [--agent auto\|claude\|codex\|gemini\|zed\|all] [--no-verify] [--relative-command]` | Register codeintel with the agents installed on this machine (`auto`, the default), then prove it by completing a real MCP handshake against the registered command |
 | `codeintel setup [project_root] [--all] [--index] [--warm] [--install-uv] [--install-deps] [--json]` | Prepare backends + index this repo (`--all` = one command: do everything automatable, idempotent); ends with a health report + **Next:** steps |
 | `codeintel prompt [project_root] [--agent auto\|claude\|codex\|gemini\|zed] [--fresh] [--deep]` | Print a paste-to-your-agent setup prompt; probes health and emits only the outstanding steps (or "just restart me" when already healthy). `--fresh` = the full sequence from `pip install`, to send a friend |
-| `codeintel index [project_root]` | Index a project for semantic search |
+| `codeintel index [project_root] [--quiet]` | Index a repo (semantic embeddings + best-effort graph & map refresh), with a live progress display; `--quiet` prints only the result line |
 | `codeintel serve` | Start the MCP server (stdio transport) |
 | `codeintel serve-http [--host HOST] [--port 8766] [--allow-remote] [--token TOKEN]` | Start the HTTP transport (loopback-only unless `--allow-remote`; `--token` requires a bearer token on every request) |
 | `codeintel query --op OP --target TARGET [--engine auto] [--project-root DIR] [--json]` | Run a single query and print the result |
@@ -404,10 +404,10 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel graph [project_root] [--html] [--out FILE] [--limit N]` | Emit the call graph as `{nodes,edges}` JSON, or `--html` a self-contained interactive viewer — see [docs/graph-viewer.md](docs/graph-viewer.md) |
-| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel reset [project_root] [--all] [--yes] [--json]` | Clear this repo's index — **both** semantic and graph — so it's as if never indexed; `--all` wipes every repo. Recovers from a corrupt/stale DB |
 | `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
-Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
+Human-facing commands (`doctor`, `setup`, `prompt`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
 **Exit codes**, so a `make` target or CI step can gate on `$?`:
 
@@ -444,7 +444,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
 | `CODEINTEL_DEBUG=1` | Log the full traceback of any error the never-throw contract swallows (silent by default) — the switch for diagnosing an unexpected `null` |
 | `CODEINTEL_REINDEX=off` | Disable the background reindexer; queries then index inline to stay fresh |
-| `CODEINTEL_HOME` | Where the index cache lives (default `~/.codeintel`). Set this when the process has **no resolvable home directory** — a container running as a UID with no passwd entry and no `$HOME`, which is common when an agent runs in one. Without it, `Path.home()` raises and every command fails somewhere far from the cause. |
+| `CODEINTEL_HOME` | Where per-machine state lives (default `~/.codeintel`) — the index cache, the global `config.toml`, and `auth.toml`. Set this when the process has **no resolvable home directory** — a container running as a UID with no passwd entry and no `$HOME`, which is common when an agent runs in one. Without it, `Path.home()` raises and every command fails somewhere far from the cause. |
 
 ## Privacy & dependencies
 
@@ -617,7 +617,7 @@ git clone https://github.com/hamilton-sky/codeintel.git
 cd codeintel
 pip install -e .[dev]
 
-pytest tests/ -q            # ~620 tests, ~30s; fails under 83% coverage
+pytest tests/ -q            # ~740 tests, ~30s; fails under 83% coverage
 ruff check src tests        # lint
 mypy                        # types (src/ only)
 ```

{codecortex-0.16.0 → codecortex-0.18.0}/src/codecortex.egg-info/SOURCES.txt

@@ -30,7 +30,9 @@ src/codeintel/mapper.py
 src/codeintel/metrics.py
 src/codeintel/onboarding.py
 src/codeintel/outcome.py
+src/codeintel/paths.py
 src/codeintel/policy.py
+src/codeintel/progress.py
 src/codeintel/provider.py
 src/codeintel/py.typed
 src/codeintel/redact.py
@@ -89,6 +91,8 @@ tests/test_hardening.py
 tests/test_http_auth.py
 tests/test_http_server.py
 tests/test_incompleteness.py
+tests/test_index_progress.py
+tests/test_indexer_binary.py
 tests/test_installer.py
 tests/test_integration.py
 tests/test_loc_census.py
@@ -101,11 +105,14 @@ tests/test_model_dimension.py
 tests/test_never_raise.py
 tests/test_onboarding.py
 tests/test_rbac.py
+tests/test_redaction_boundary.py
 tests/test_reindexer.py
 tests/test_rerank.py
 tests/test_reset.py
 tests/test_semantic_provider.py
 tests/test_source_kind.py
+tests/test_staleness.py
+tests/test_symbol_context.py
 tests/test_term.py
 tests/test_treesitter.py
 tests/test_verify.py

codecortex-0.18.0/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.18.0"

{codecortex-0.16.0 → codecortex-0.18.0}/src/codeintel/__main__.py

@@ -131,13 +131,19 @@ def main() -> None:
     subparsers.add_parser("serve", help="Start the MCP server")
 
     # index subcommand
-    index_parser = subparsers.add_parser("index", help="Index a project for semantic search")
+    index_parser = subparsers.add_parser(
+        "index", parents=[color_parent],
+        help="Index a project for semantic search")
     index_parser.add_argument(
         "project_root",
         nargs="?",
         default=None,
         help="Project root directory (default: cwd)",
     )
+    index_parser.add_argument(
+        "--quiet", "-q", action="store_true",
+        help="Suppress the live progress display and header; keep only the result line",
+    )
 
     # query subcommand
     query_parser = subparsers.add_parser("query", help="Query the code intelligence engine")

{codecortex-0.16.0 → codecortex-0.18.0}/src/codeintel/auth.py

@@ -26,6 +26,7 @@ import os
 import pathlib
 import tomllib  # stdlib on Python 3.11+ (the project's minimum)
 
+from codeintel.paths import codeintel_home
 from codeintel.policy import TieringPolicy
 
 logger = logging.getLogger("codeintel")
@@ -78,7 +79,13 @@ def _auth_config_path() -> pathlib.Path | None:
     if env:
         p = pathlib.Path(env)
         return p if p.is_file() else None
-    default = pathlib.Path.home() / ".codeintel" / "auth.toml"
+    try:
+        default = codeintel_home() / "auth.toml"
+    except Exception:
+        # No CODEINTEL_HOME and no resolvable home. `load_auth` promises never to raise, and its
+        # whole contract is "absent config → auth disabled"; a host with nowhere to look is the
+        # absent case, not a crash. (Previously this read `Path.home()` inline and raised.)
+        return None
     return default if default.is_file() else None
 
 

codecortex-0.18.0/src/codeintel/commands/index.py

@@ -0,0 +1,144 @@
+"""`codeintel index` — build the semantic index, then best-effort refresh the graph and the map."""
+
+import logging
+import os
+from typing import Any
+
+from codeintel.commands._common import resolve_root
+
+
+class _ProgressLogBridge(logging.Handler):
+    """Routes WARNING+ log records from the indexer to a live progress counter's ``notice()``, so a
+    per-file skip warning prints as a clean permanent line ABOVE the redrawing status line instead
+    of colliding with it (``0 chunksskipping …``). Installed only for a live (TTY) run and removed
+    the moment indexing returns — a non-TTY has no live line to protect, and the warnings keep their
+    normal stderr path there."""
+
+    def __init__(self, counter: Any) -> None:
+        super().__init__(level=logging.WARNING)
+        self._counter = counter
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            self._counter.notice(record.getMessage())
+        except Exception:
+            pass
+
+
+def run(args: Any) -> int:
+    import sys
+
+    import codeintel.term as term
+    from codeintel.config import load_config
+    from codeintel.indexer import Indexer
+    from codeintel.semantic_db import SemanticDb, default_db_path
+
+    project_root = resolve_root(args)
+    # Validate before doing anything. `codeintel index /typo/path` walked nothing, found nothing,
+    # and printed "Nothing new to index" at exit 0 — indistinguishable from a correct incremental
+    # run, which is the worst possible response to a mistyped path in a script.
+    if not os.path.isdir(project_root):
+        print(f"index failed: not a directory: {project_root}")
+        return 1
+
+    # A console bound to the CURRENT stdout (honouring --no-color/--ascii/NO_COLOR), so progress is
+    # captured under test and routed correctly whether or not main() already ran configure(). The
+    # LiveCounter auto-goes silent on a non-TTY; --quiet suppresses it (and the header) outright.
+    console = term.Console(
+        stream=sys.stdout,
+        no_color=getattr(args, "no_color", False),
+        ascii_mode=(True if getattr(args, "ascii", False) else None),
+    )
+    quiet = getattr(args, "quiet", False)
+    counter = None if quiet else term.LiveCounter(console)
+
+    failed = False
+    # Wrap the whole semantic pass so a setup failure (e.g. an unresolvable home dir →
+    # Path.home() raising) degrades with a message, like every other subcommand, not a traceback.
+    try:
+        cfg = load_config(project_root)
+        if not quiet:
+            # One dim header naming the model + chunk strategy: it says WHAT is running (and that it
+            # is all local), and on a cold cache it pre-explains the model-download stall.
+            strat = str(cfg.get("chunk_strategy", "syntax"))
+            strat_label = "def-aligned" if strat == "syntax" else "line-window"
+            model = str(cfg.get("model") or "BAAI/bge-small-en-v1.5")
+            sep = "." if console.ascii else "·"
+            print(console.header("index", project_root))
+            print(f"  {console.dim(f'{model} {sep} {strat_label} chunks')}")
+            print()
+        db_path = default_db_path(str(cfg.get("model") or ""))
+        os.makedirs(os.path.dirname(db_path), exist_ok=True)
+        db = SemanticDb(db_path)
+        # While a live status line is on screen, the indexer's skip WARNINGs must not print raw to
+        # the terminal (they land mid-line). Route them through the counter's notice() for the span
+        # of the index pass only; a non-TTY needs no bridge (its status lines end in \n).
+        bridge = _ProgressLogBridge(counter) if (counter is not None and counter.live) else None
+        idx_logger = logging.getLogger("codeintel")
+        try:
+            db.init()
+            if bridge is not None:
+                idx_logger.addHandler(bridge)
+            try:
+                count = Indexer(
+                    db,
+                    model_name=str(cfg.get("model") or "BAAI/bge-small-en-v1.5"),
+                    window=int(cfg.get("window", 20)),
+                    stride=int(cfg.get("stride", 10)),
+                    max_chunks=int(cfg.get("max_chunks", 500)),
+                    max_total_chunks=int(cfg.get("max_total_chunks", 100000)),
+                    chunk_strategy=str(cfg.get("chunk_strategy", "syntax")),
+                    progress=counter,
+                ).index(project_root)
+            finally:
+                if bridge is not None:
+                    idx_logger.removeHandler(bridge)
+            # Seal the live line before the plain summary: commit the ✓ row on real work, else erase
+            # it so "Nothing new" / the failure message stands on its own clean line.
+            if counter:
+                counter.finish(commit=count > 0)
+            if count > 0:
+                print(f"Indexed {count} chunks")
+            elif count < 0:
+                # Indexer.index() returns -1 for an unrecoverable failure. `> 0` sent that into
+                # the "Nothing new to index" branch, so a total failure read as a clean no-op.
+                print("index failed — the indexer could not complete (see the warnings above)")
+                failed = True
+            else:
+                print("Nothing new to index")
+        finally:
+            db.close()
+    except Exception as exc:
+        if counter:
+            counter.finish(commit=False)
+        print(f"index failed: {exc}")
+        failed = True
+
+    # best-effort graph reindex — an opaque subprocess, so a ticking elapsed heartbeat is the honest
+    # fidelity (no counts cross the boundary): the number keeps moving so a minute-long reindex never
+    # reads as a hang, but we never fabricate a percentage we can't see.
+    import shutil
+
+    if shutil.which("codebase-memory-mcp"):
+        beat = None if quiet else term.LiveHeartbeat(console, "graph reindex").start()
+        try:
+            from codeintel.reindexer import Reindexer
+
+            Reindexer()._graph_reindex(project_root)
+            if beat:
+                beat.stop("ok")
+        except Exception:
+            if beat:
+                beat.stop("warn", "skipped")
+
+    # best-effort map refresh after index (fast, kept silent — not worth a checklist row)
+    try:
+        from codeintel.mapper import MapGenerator
+        from codeintel.providers.graph import GraphProvider
+
+        gen = MapGenerator(GraphProvider())
+        gen.write(project_root, gen.generate(project_root))
+    except Exception:
+        pass
+
+    return 1 if failed else 0

{codecortex-0.16.0 → codecortex-0.18.0}/src/codeintel/commands/reset.py

@@ -1,4 +1,4 @@
-"""`codeintel reset` — clear the semantic index (recover from a corrupt/stale DB)."""
+"""`codeintel reset` — clear a repo's index (semantic + graph), or the whole cache with --all."""
 
 import sys
 from typing import Any
@@ -18,7 +18,7 @@ def run(args: Any) -> int:
             return 1
         target = "ALL projects" if args.all else project_root
         count = preview.get("count", 0)
-        ans = input(f"Reset semantic index for {target} ({count} entries)? [y/N] ").strip().lower()
+        ans = input(f"Reset index for {target} ({count} entries)? [y/N] ").strip().lower()
         if ans not in ("y", "yes"):
             print("aborted")
             return 0

{codecortex-0.16.0 → codecortex-0.18.0}/src/codeintel/config.py

@@ -4,6 +4,8 @@ import logging
 import pathlib
 import tomllib  # stdlib since 3.11, which is this package's floor
 
+from codeintel.paths import codeintel_home
+
 logger = logging.getLogger("codeintel")
 
 _DEFAULTS: dict = {
@@ -18,7 +20,12 @@ _DEFAULTS: dict = {
     "model": "BAAI/bge-small-en-v1.5",
     "chunk_strategy": "syntax",  # syntax-aware (def/class boundaries) vs fixed line windows
     "rerank": "on",              # hybrid lexical+semantic rerank of search results
-    "rerank_candidates": 30,     # cosine candidates fused/re-ranked before returning top-k
+    # Cosine candidates retrieved, fused and re-ranked before the top-k is returned. Was 30, but
+    # the semantic provider hardcoded its own `_display_k * 6` widening that overrode it, so the
+    # effective breadth has always been 60; 30 only ever described behaviour the code didn't have.
+    # The provider now honours this key, so the default is set to the value that was really in use
+    # — otherwise "fixing" the wiring would have silently narrowed everyone's retrieval by half.
+    "rerank_candidates": 60,
 }
 
 # Values restricted to a fixed set — anything else falls back to the default.
@@ -80,12 +87,27 @@ def _coerce(cfg: dict) -> dict:
     return out
 
 
+def _global_config() -> dict:
+    """The machine-wide ``config.toml``, or ``{}`` when there isn't one.
+
+    Resolving the directory can RAISE (no ``CODEINTEL_HOME`` and no resolvable home — a container
+    UID with no passwd entry). That used to propagate straight out of ``load_config``: the call
+    read ``pathlib.Path.home()`` inline, so it blew up before ``_read_toml``'s handler could see
+    it, and every query on such a host died as an opaque ``provider-error``. "There is nowhere to
+    look for a global config" is not an error — it means there is no global config."""
+    try:
+        return _read_toml(codeintel_home() / "config.toml")
+    except Exception as exc:
+        logger.debug("no resolvable config directory (%s) — using defaults + project config", exc)
+        return {}
+
+
 def load_config(project_root: str | None = None) -> dict:
     """Return the merged, validated config: defaults < global < project. Values that fail
     validation fall back to their default (logged), so a bad config file never breaks a query."""
     root = pathlib.Path(project_root) if project_root is not None else pathlib.Path.cwd()
 
-    global_cfg = _read_toml(pathlib.Path.home() / ".codeintel" / "config.toml")
+    global_cfg = _global_config()
     project_cfg = _read_toml(root / ".codeintel.toml")
 
     merged = {**_DEFAULTS, **global_cfg, **project_cfg}

{codecortex-0.16.0 → codecortex-0.18.0}/src/codeintel/containment.py

@@ -69,9 +69,24 @@ def open_contained(root_real: str, candidate: str | Path, **kwargs):
     Raises ``ContainmentError`` rather than returning a sentinel, so a caller that wraps reads in a
     broad ``except Exception`` cannot quietly downgrade an escape to "file not found" — the escape
     is logged at WARNING here regardless of what the caller does with the exception.
+
+    A path that simply DOES NOT EXIST is reported as ``FileNotFoundError``, not as an escape.
+    ``contained_path`` answers the single question "may this be read", and a deleted file is a
+    legitimate no — but it is also the most ordinary thing that can happen to an indexed file, and
+    reporting it as a refusal meant every deletion between indexing and a query logged a WARNING
+    asking whether a symlink had been "planted after indexing" and rendered the hit as
+    ``[refused: resolves outside the indexed root]``. That is a false security alarm on a routine
+    event, and it drowns the real ones. The distinction is made HERE rather than by relaxing
+    ``contained_path``, whose ``None`` also drives ``_cleanup_deleted``'s reconciliation of deleted
+    files — loosening it there would leave their rows in the index forever.
     """
     safe = contained_path(root_real, candidate)
     if safe is None:
+        # lexists(), not exists(): a dangling symlink still EXISTS as a link, and a link whose
+        # target vanished is a construct worth refusing loudly rather than calling "not found".
+        if not os.path.lexists(candidate):
+            logger.debug("indexed file no longer exists: %s", candidate)
+            raise FileNotFoundError(str(candidate))
         logger.warning(
             "refusing to read %s — it does not resolve to a file inside %s (symlink or hard link "
             "planted after indexing?)", candidate, root_real,

{codecortex-0.16.0 → codecortex-0.18.0}/src/codeintel/gateway.py

@@ -24,7 +24,6 @@ _AUTO_ENGINE: dict[str, str] = {
     "overview": "graph",
     "changed": "graph",
     "changes": "graph",
-    "deadcode": "graph",
     "hotspots": "graph",
     "symbol": "lsp",
     "search": "semantic",
@@ -33,8 +32,9 @@ _AUTO_ENGINE: dict[str, str] = {
 
 # Ops whose answer depends on live, unhashable state (the git worktree) rather than the indexed
 # content the cache key is built from — caching them would serve a stale answer within a freshness
-# generation. `changed` reads uncommitted edits; `deadcode`/`hotspots` are pure functions of the
-# index and stay cached (correctly keyed by the freshness generation).
+# generation. `changed` reads uncommitted edits; `hotspots` is a pure function of the index and
+# stays cached (correctly keyed by the freshness generation). A retired/unknown op falls through
+# to the graph engine (the `_AUTO_ENGINE.get(op, "graph")` default), which safe-nulls it.
 _UNCACHED_OPS: frozenset[str] = frozenset({"changed", "changes"})
 
 # Engines whose slot can be filled after construction (see `Gateway.adopt_provider`).