codecortex 0.23.1__tar.gz → 0.23.2__tar.gz

{codecortex-0.23.1/src/codecortex.egg-info → codecortex-0.23.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.23.1
+Version: 0.23.2
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT

{codecortex-0.23.1 → codecortex-0.23.2/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.23.1
+Version: 0.23.2
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT

codecortex-0.23.2/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.23.2"

{codecortex-0.23.1 → codecortex-0.23.2}/src/codeintel/gateway.py

@@ -292,17 +292,22 @@ class Gateway:
             # codebase throws away the could-not-ask / asked-and-found-nothing distinction it is
             # otherwise careful to preserve per-provider.
             reasons = {eng: str(r.get("reason") or "no-result") for eng, r in results.items()}
-            unreachable = {"engine-unavailable", "boot-failed", "warming", "project-not-indexed",
-                           "project-not-indexed-standalone", "error", "timeout",
-                           # An index pass that RAN and FAILED is a could-not-ask, not a
-                           # found-nothing. `no-index` deliberately stays out: it means the pass
-                           # completed and there was nothing to embed, which is an answer.
-                           "index-failed",
-                           # A query the embedder could not encode. No search ran, so the empty
-                           # result says nothing about the repository — the same reasoning as
-                           # `index-failed`, one step later in the pipeline.
-                           "query-failed"}
-            all_unreachable = bool(reasons) and all(v in unreachable for v in reasons.values())
+            # Providers have already classified their reason into the public outcome taxonomy.
+            # Repeating a private reason allow-list here guaranteed drift: the first new reason,
+            # ``source-unreadable``, was correctly marked unavailable by LSP and then collapsed
+            # back to ``not_found`` by this merge.  Failed and unavailable both mean no engine was
+            # able to answer; an actual miss is the explicit ``not_found`` outcome.
+            # Older/custom providers may not have adopted ``outcome`` yet. Route their reason
+            # through the SAME central classifier rather than reintroducing a local allow-list.
+            classified = [
+                r.get("outcome") or safe_null_result(
+                    op_str, target_str, engine=eng, reason=reasons[eng]
+                ).get("outcome")
+                for eng, r in results.items()
+            ]
+            all_unreachable = bool(classified) and all(
+                outcome in ("unavailable", "failed") for outcome in classified
+            )
             summary = "engines-unavailable" if all_unreachable else "no-result"
             detail = ", ".join(f"{eng}: {why}" for eng, why in sorted(reasons.items()))
             return safe_null_result(

{codecortex-0.23.1 → codecortex-0.23.2}/src/codeintel/indexer.py

@@ -390,7 +390,19 @@ class Indexer:
             root_real = real_root(str(root))
         except Exception:
             root_real = str(root)
-        for dirpath, dirnames, filenames in os.walk(root):
+        def fail_on_unreadable_tree(error: OSError) -> None:
+            """Do not turn an unreadable subtree into a successful empty index.
+
+            ``os.walk`` silently ignores directory-enumeration failures unless an ``onerror``
+            callback is supplied.  On macOS this is particularly dangerous for folders protected
+            by Files & Folders / Full Disk Access: the root can pass ``isdir`` while every source
+            directory raises ``EPERM``, leaving the CLI to report "Nothing new to index" at exit
+            zero.  Propagating the original error preserves its path and lets ``index()`` expose a
+            truthful, actionable failure.
+            """
+            raise error
+
+        for dirpath, dirnames, filenames in os.walk(root, onerror=fail_on_unreadable_tree):
             at_root = os.path.realpath(dirpath) == os.path.realpath(real_root_str)
             dirnames[:] = [
                 d for d in dirnames

{codecortex-0.23.1 → codecortex-0.23.2}/src/codeintel/provider.py

@@ -75,20 +75,31 @@ def safe_null_result(
     hint: str | None = None,
 ) -> Result:
     failed_reasons = {
-        "backend-error", "backend-incompatible", "boot-failed", "error", "index-failed",
-        "provider-error", "timeout", "unparsable",
+        "backend-error", "backend-incompatible", "boot-failed", "error", "gateway-error",
+        "handler-error", "index-failed", "provider-error", "query-failed", "timeout",
+        "unparsable",
     }
     unavailable_reasons = {
-        "engine-unavailable", "engines-unavailable", "indexing-in-progress", "no-engine",
-        "no-index", "no-project-root", "op-not-supported", "project-not-indexed",
-        "project-not-indexed-standalone", "unsupported-op", "warming",
+        "backend-unreachable", "engine-unavailable", "engines-unavailable", "indexing-in-progress",
+        "index-stale", "no-engine", "no-project-root", "op-not-allowed-for-role",
+        "op-not-supported", "op-withdrawn", "project-not-indexed",
+        "project-not-indexed-standalone", "root-not-allowed-for-role", "source-unreadable",
+        "unknown-engine", "unsupported-op", "warming",
+    }
+    not_found_reasons = {
+        "below-floor", "no-edges", "no-index", "no-result", "not-found", "not-in-graph",
     }
     if reason in failed_reasons:
         outcome = "failed"
     elif reason in unavailable_reasons:
         outcome = "unavailable"
-    else:
+    elif reason in not_found_reasons:
         outcome = "not_found"
+    else:
+        # New failure reasons must fail closed.  Defaulting every unknown string to ``not_found``
+        # turned a newly introduced ``source-unreadable`` reason into an assertion that the symbol
+        # was absent — exactly the ambiguity the explicit outcome field was added to remove.
+        outcome = "failed"
     r: Result = {
         "ok": True,
         "op": str(op or ""),

{codecortex-0.23.1 → codecortex-0.23.2}/src/codeintel/providers/lsp.py

@@ -127,6 +127,29 @@ def _serena_launch_args(cmd: str, project_root: str) -> list[str]:
     return [cmd, *common]
 
 
+def _project_access_failure(project_root: str) -> tuple[str, str] | None:
+    """Return a safe diagnosis when the host cannot enumerate the project root.
+
+    Serena's stdio transport wraps an early subprocess exit in an ``ExceptionGroup``.  When the
+    real cause is a macOS Files & Folders denial, reporting that wrapper as a network/bootstrap
+    failure sends the user in exactly the wrong direction.  A one-entry scan is cheap, local, and
+    establishes the prerequisite Serena itself needs without forwarding any backend-controlled
+    prose to the calling agent.
+    """
+    try:
+        with os.scandir(project_root) as entries:
+            next(entries, None)
+    except OSError as exc:
+        location = str(getattr(exc, "filename", None) or project_root)
+        detail = f"repository root is not readable by codeintel ({type(exc).__name__}: {location})"
+        remediation = (
+            "grant the codeintel host read access to the repository, then retry; on macOS check "
+            "System Settings > Privacy & Security > Files and Folders (or Full Disk Access)"
+        )
+        return detail, remediation
+    return None
+
+
 class _State(enum.Enum):
     WARMING = "WARMING"
     READY = "READY"
@@ -433,6 +456,12 @@ class LspProvider:
                     "detail": "serena session is warming for this repo", "remediation": None}
 
         # deep: boot (or reuse) a session and poll to a hard deadline — never hangs.
+        access_failure = _project_access_failure(project_root)
+        if access_failure is not None:
+            detail, remediation = access_failure
+            return {"installed": True, "runnable": False, "repo_indexed": None,
+                    "detail": detail, "remediation": remediation}
+
         session = self._get_or_create_session(project_root)
         deadline = time.monotonic() + timeout_s
         while time.monotonic() < deadline:
@@ -502,6 +531,21 @@ class LspProvider:
             if not self.available:
                 return safe_null_result(op_str, target_str, engine="lsp", reason="engine-unavailable")
 
+            # A protected macOS folder can still satisfy ``isdir`` while denying enumeration.
+            # Detect that locally before spawning Serena: otherwise its early exit is wrapped by
+            # the MCP transport as a generic boot failure and the first-query hint talks about a
+            # cold uvx cache instead of the permission the user actually needs to grant.  Keep the
+            # ``isdir`` guard so synthetic/nonexistent roots used by embedders retain the existing
+            # never-raise backend behaviour.
+            if os.path.isdir(root_str):
+                access_failure = _project_access_failure(root_str)
+                if access_failure is not None:
+                    detail, remediation = access_failure
+                    return safe_null_result(
+                        op_str, target_str, engine="lsp", reason="source-unreadable",
+                        hint=f"{detail}; {remediation}",
+                    )
+
             try:
                 budget_ms = int(budget) if budget else 0
             except Exception:

{codecortex-0.23.1 → codecortex-0.23.2}/tests/test_doctor.py

@@ -316,6 +316,27 @@ def test_lsp_probe_deep_boot_failure_is_bounded(monkeypatch):
     assert r["runnable"] in (False, None)  # failed to boot (or timed out) — never True
 
 
+def test_lsp_probe_reports_repository_access_before_blaming_network(monkeypatch):
+    monkeypatch.setattr("codeintel.providers.lsp.shutil.which", lambda x: "/fake/uvx")
+    monkeypatch.setattr(
+        "codeintel.providers.lsp.os.scandir",
+        lambda root: (_ for _ in ()).throw(PermissionError(1, "denied", str(root))),
+    )
+    p = LspProvider()
+    monkeypatch.setattr(
+        p, "_get_or_create_session",
+        lambda root: pytest.fail("an unreadable repository must not launch serena"),
+    )
+
+    r = p.probe("/protected/repo", deep=True)
+
+    assert r["runnable"] is False
+    assert "PermissionError" in r["detail"]
+    assert "/protected/repo" in r["detail"]
+    assert "Privacy & Security" in r["remediation"]
+    assert "network" not in r["remediation"].lower()
+
+
 # --------------------------------------------------------------------------- #
 # handler + hint plumbing
 # --------------------------------------------------------------------------- #

{codecortex-0.23.1 → codecortex-0.23.2}/tests/test_gateway.py

@@ -548,6 +548,7 @@ def test_a_fanout_where_engines_ran_and_found_nothing_still_reports_no_result():
                  lsp=_NullProvider("lsp", "not-found"))
     r = gw.query(op="context", target="nope", engine="both")
     assert r["reason"] == "no-result"
+    assert r["outcome"] == "not_found"
     assert "NOT evidence" not in (r.get("hint") or "")
 
 

{codecortex-0.23.1 → codecortex-0.23.2}/tests/test_incompleteness.py

@@ -371,8 +371,13 @@ def test_null_result_outcome_is_machine_readable():
     from codeintel.provider import safe_null_result
 
     assert safe_null_result("x", "y", reason="not-in-graph")["outcome"] == "not_found"
+    assert safe_null_result("x", "y", reason="not-found")["outcome"] == "not_found"
+    assert safe_null_result("x", "y", reason="no-index")["outcome"] == "not_found"
     assert safe_null_result("x", "y", reason="engine-unavailable")["outcome"] == "unavailable"
     assert safe_null_result("x", "y", reason="backend-error")["outcome"] == "failed"
+    assert safe_null_result("x", "y", reason="source-unreadable")["outcome"] == "unavailable"
+    assert safe_null_result("x", "y", reason="backend-unreachable")["outcome"] == "unavailable"
+    assert safe_null_result("x", "y", reason="new-unclassified-reason")["outcome"] == "failed"
 
 
 def test_a_fanned_out_answer_reports_the_engine_that_could_not_be_asked():
@@ -398,6 +403,31 @@ def test_a_fanned_out_answer_reports_the_engine_that_could_not_be_asked():
     assert "engine-unavailable" in kinds, kinds
 
 
+def test_fan_out_preserves_source_unreadable_as_unavailable():
+    """The merge must consume the public outcome, not maintain another reason allow-list.  If all
+    engines could not answer, a newly introduced reason must never collapse back to ``not_found``.
+    """
+    from codeintel.gateway import Gateway
+    from codeintel.provider import safe_null_result
+
+    merged = Gateway()._merge(
+        {
+            "lsp": safe_null_result(
+                "context", "createSession", engine="lsp", reason="source-unreadable"
+            ),
+            "graph": safe_null_result(
+                "context", "createSession", engine="graph", reason="project-not-indexed"
+            ),
+        },
+        "context", "createSession",
+    )
+
+    assert merged["result"] is None
+    assert merged["reason"] == "engines-unavailable"
+    assert merged["outcome"] == "unavailable"
+    assert "NOT evidence" in merged["hint"]
+
+
 def test_a_constituent_gap_survives_the_merge():
     from codeintel.gateway import Gateway
 

{codecortex-0.23.1 → codecortex-0.23.2}/tests/test_index_failure_reason.py

@@ -326,6 +326,31 @@ def test_other_failures_keep_their_type_prefix(monkeypatch, tmp_path):
     assert indexer.last_error == "PermissionError: read-only file system"
 
 
+def test_an_unreadable_subtree_is_not_a_successful_empty_walk(monkeypatch, tmp_path):
+    """``os.walk`` ignores enumeration errors by default.  A macOS-protected repository could
+    therefore scan as zero files and make the CLI print "Nothing new to index" at exit zero even
+    though no source was readable.  The original permission error, including its path, must escape
+    the walk so ``Indexer.index`` can report it as an unrecoverable failure.
+    """
+    import codeintel.indexer as indexer_module
+    from codeintel.indexer import Indexer
+
+    protected = tmp_path / "protected-repo"
+
+    def denied_walk(root, *, onerror=None):
+        assert onerror is not None
+        onerror(PermissionError(1, "Operation not permitted", str(protected)))
+        return []
+
+    monkeypatch.setattr(indexer_module.os, "walk", denied_walk)
+    monkeypatch.setattr(indexer_module, "load_gitattributes_globs", lambda root: [])
+    indexer = Indexer.__new__(Indexer)
+    monkeypatch.setattr(indexer, "_load_gitignore", lambda root: set())
+
+    with pytest.raises(PermissionError, match="protected-repo"):
+        list(indexer._walk_files(tmp_path))
+
+
 def test_the_searcher_reports_it_too(monkeypatch):
     """A query is the other way a cold cache is discovered — stage-qualified, message verbatim."""
     from codeintel.searcher import Searcher

{codecortex-0.23.1 → codecortex-0.23.2}/tests/test_lsp_provider.py

@@ -6,6 +6,8 @@ import time
 from typing import Any
 from unittest.mock import MagicMock
 
+import pytest
+
 from codeintel.outcome import Missing, Ok
 from codeintel.providers.lsp import LspProvider, _State
 from codeintel.server import code_status_handler
@@ -462,6 +464,32 @@ def test_boot_failed_on_a_cold_uvx_first_attempt_reads_as_retry(monkeypatch):
     assert "download" in hint
 
 
+def test_an_unreadable_repository_never_launches_serena(monkeypatch):
+    monkeypatch.setattr("codeintel.providers.lsp.shutil.which",
+                        lambda x: "/fake/uvx" if x == "uvx" else None)
+    monkeypatch.setattr("codeintel.providers.lsp.os.path.isdir", lambda root: True)
+    monkeypatch.setattr(
+        "codeintel.providers.lsp._project_access_failure",
+        lambda root: (
+            f"repository root is not readable by codeintel (PermissionError: {root})",
+            "grant repository access",
+        ),
+    )
+    p = LspProvider()
+    monkeypatch.setattr(
+        p, "_get_or_create_session",
+        lambda root: pytest.fail("an unreadable repository must not launch serena"),
+    )
+
+    r = p.build_result("symbol", "createSession", [], 1000, "/protected/repo")
+
+    assert r["result"] is None
+    assert r["reason"] == "source-unreadable"
+    assert r["outcome"] == "unavailable"
+    assert "PermissionError" in r["hint"]
+    assert "grant repository access" in r["hint"]
+
+
 def test_boot_failed_on_a_respawn_does_not_blame_a_cold_cache(monkeypatch):
     """`uvx` populated its cache on the first attempt, so "still downloading" is only true once."""
     monkeypatch.setattr("codeintel.providers.lsp.shutil.which",

{codecortex-0.23.1 → codecortex-0.23.2}/tests/test_semantic_provider.py

@@ -478,4 +478,5 @@ def test_a_fanout_where_the_repo_is_merely_unindexed_keeps_its_ordinary_summary(
     r = gw.query(op="context", target="make_widget", engine="all", project_root="/x")
 
     assert r["reason"] == "no-result"
+    assert r["outcome"] == "not_found"
     assert "NOT evidence" not in (r.get("hint") or "")

codecortex-0.23.1/src/codeintel/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.23.1"