codegraph-brain 0.23.1__tar.gz → 0.23.2__tar.gz

codegraph_brain-0.23.2/.github/workflows/mcp-registry.yml

@@ -0,0 +1,81 @@
+name: Publish to MCP Registry
+
+# A separate workflow file, not a job in release-please.yml: PyPI trusted
+# publishing is bound to that file, so nothing here can mint a PyPI upload token
+# whatever the publisher's environment restriction is (#471).
+#
+# Runs after every Release Please run and publishes only a tagged version the
+# registry does not list yet (scripts/mcp_registry_gate.sh), so ordinary pushes
+# to main are no-ops.
+#
+# A failed Release Please run (PyPI publish or relock) skips this workflow: the
+# red run is the signal. Recover with "Re-run failed jobs" there, or dispatch
+# this workflow on main.
+on:
+  workflow_run:
+    workflows: ["Release Please"]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: mcp-registry
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish server.json
+    # Dispatch only from main, so an older branch can't publish its own server.json.
+    # The repository check is defence in depth: Release Please never runs for forks.
+    if: >-
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # OIDC for `mcp-publisher login github-oidc`: no stored registry secret.
+      id-token: write
+    env:
+      # Pinned and checksum-verified: this job holds a registry identity, so it must
+      # not run whatever `releases/latest` happens to be. Bump both together; a
+      # binary too old for the registry fails login with "invalid audience".
+      MCP_PUBLISHER_VERSION: "1.8.1"
+      MCP_PUBLISHER_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
+    steps:
+      - name: Checkout the released commit
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          persist-credentials: false
+
+      - name: Decide whether to publish
+        id: gate
+        run: bash scripts/mcp_registry_gate.sh check >> "$GITHUB_OUTPUT"
+
+      - name: Wait for the version on PyPI
+        if: steps.gate.outputs.publish == 'true'
+        run: bash scripts/mcp_registry_gate.sh wait-pypi
+
+      - name: Install mcp-publisher
+        if: steps.gate.outputs.publish == 'true'
+        run: |
+          set -euo pipefail
+          url="https://github.com/modelcontextprotocol/registry/releases/download/v${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz"
+          curl --proto '=https' --tlsv1.2 -fsSL "$url" -o mcp-publisher.tar.gz
+          echo "${MCP_PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum --check --strict
+          tar -xzf mcp-publisher.tar.gz mcp-publisher
+
+      - name: Validate server.json
+        if: steps.gate.outputs.publish == 'true'
+        run: ./mcp-publisher validate
+
+      - name: Log in with GitHub OIDC
+        if: steps.gate.outputs.publish == 'true'
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish
+        if: steps.gate.outputs.publish == 'true'
+        run: ./mcp-publisher publish

codegraph_brain-0.23.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.23.2"
+}

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.23.2](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.23.1...codegraph-brain-v0.23.2) (2026-09-17)
+
+
+### Bug Fixes
+
+* **cli:** impact/trace list each neighbour once, JSON each edge once ([#475](https://github.com/zaebee/codegraph-brain/issues/475)) ([9c93b4b](https://github.com/zaebee/codegraph-brain/commit/9c93b4ba5748f99fe2aeb43d698c9d9628e6295a))
+
 ## [0.23.1](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.23.0...codegraph-brain-v0.23.1) (2026-09-17)
 
 

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codegraph-brain
-Version: 0.23.1
+Version: 0.23.2
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.23.1"
+version = "0.23.2"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"

codegraph_brain-0.23.2/scripts/mcp_registry_gate.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Decide whether server.json's version should be published to the MCP Registry,
+# and wait until PyPI can back it (#471).
+#
+#   scripts/mcp_registry_gate.sh check     → prints publish=true|false (for $GITHUB_OUTPUT)
+#   scripts/mcp_registry_gate.sh wait-pypi → blocks until PyPI serves the version
+#
+# `check` is what makes the workflow safe to run after *every* Release Please run:
+# only a tagged release that the registry does not list yet is published, so a
+# docs push to main is a no-op and a re-run never double-publishes.
+#
+# Every lookup fails closed. `publish=false` is printed only on a definite answer
+# (no such tag, version already listed); a network error or an unexpected
+# response exits non-zero, because a silently skipped release is exactly what
+# this automation exists to prevent.
+#
+# `wait-pypi` exists because the registry verifies ownership by fetching
+# pypi.org/pypi/<pkg>/<version>/json and looking for the mcp-name marker, and a
+# fresh upload is not always visible there straight away (0.23.0 and 0.23.1 both
+# failed a `pip install` for a few minutes after the publish job went green).
+set -euo pipefail
+
+REGISTRY="${MCP_REGISTRY_URL:-https://registry.modelcontextprotocol.io}"
+PYPI="${PYPI_URL:-https://pypi.org}"
+TAG_PREFIX="${TAG_PREFIX:-codegraph-brain-v}"
+WAIT_SECONDS="${WAIT_SECONDS:-600}"
+POLL_SECONDS="${POLL_SECONDS:-15}"
+
+fail() {
+  echo "::error::$*" >&2
+  exit 1
+}
+
+read_field() {
+  local filter="$1" label="$2" value
+  value=$(jq -r "${filter} // empty" server.json) || fail "server.json is not valid JSON."
+  [[ -n "$value" ]] || fail "server.json has no ${label} (${filter})."
+  printf '%s' "$value"
+}
+
+name=$(read_field .name "server name")
+version=$(read_field .version "version")
+package=$(read_field 'first(.packages[]? | select(.registryType == "pypi") | .identifier)' "PyPI package")
+
+check() {
+  local tag="refs/tags/${TAG_PREFIX}${version}" rc=0
+  git ls-remote --exit-code --tags origin "$tag" >/dev/null || rc=$?
+  case "$rc" in
+    0) ;;
+    2)
+      echo "No tag ${TAG_PREFIX}${version}: not a release, nothing to publish." >&2
+      echo "publish=false"
+      return
+      ;;
+    *) fail "git ls-remote for ${tag} failed (exit ${rc}); cannot tell whether this is a release." ;;
+  esac
+
+  # The status alone is not enough: a moved API also answers 404, and a proxy can
+  # answer 200 with nothing. Each answer must also carry the body that means it.
+  local encoded body status
+  encoded=$(jq -rn --arg n "$name" '$n | @uri')
+  body=$(mktemp)
+  status=$(curl -sS -o "$body" -w '%{http_code}' \
+    "${REGISTRY}/v0/servers/${encoded}/versions/${version}") ||
+    fail "Registry lookup for ${name} ${version} failed."
+  if [[ "$status" == 200 ]] &&
+    jq -e --arg n "$name" --arg v "$version" \
+      '.server.name == $n and .server.version == $v' "$body" >/dev/null 2>&1; then
+    echo "${name} ${version} is already in the registry." >&2
+    echo "publish=false"
+  elif [[ "$status" == 404 ]] &&
+    jq -e '.detail == "Server not found"' "$body" >/dev/null 2>&1; then
+    echo "${name} ${version} is released and not in the registry yet." >&2
+    echo "publish=true"
+  else
+    fail "Unexpected registry answer for ${name} ${version}: HTTP ${status}, $(head -c 200 "$body")"
+  fi
+  rm -f "$body"
+}
+
+wait_pypi() {
+  local marker="mcp-name: ${name}" deadline=$((SECONDS + WAIT_SECONDS))
+  until curl -fsS "${PYPI}/pypi/${package}/${version}/json" 2>/dev/null |
+    jq -e --arg m "$marker" '(.info.description // "") | contains($m)' >/dev/null 2>&1; do
+    if [[ "$SECONDS" -ge "$deadline" ]]; then
+      fail "${package} ${version} with '${marker}' not on PyPI after ${WAIT_SECONDS}s." \
+        "Publish manually once it is: mcp-publisher login github && mcp-publisher publish"
+    fi
+    sleep "$POLL_SECONDS"
+  done
+  echo "${package} ${version} is on PyPI with the mcp-name marker." >&2
+}
+
+case "${1:-}" in
+  check) check ;;
+  wait-pypi) wait_pypi ;;
+  *)
+    echo "usage: $0 check|wait-pypi" >&2
+    exit 2
+    ;;
+esac

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/server.json

@@ -8,13 +8,13 @@
     "source": "github",
     "id": "1260843154"
   },
-  "version": "0.23.1",
+  "version": "0.23.2",
   "packages": [
     {
       "registryType": "pypi",
       "registryBaseUrl": "https://pypi.org",
       "identifier": "codegraph-brain",
-      "version": "0.23.1",
+      "version": "0.23.2",
       "runtimeHint": "uvx",
       "transport": {
         "type": "stdio"

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/src/cgis/cli.py

@@ -20,6 +20,7 @@ style tags you wrote yourself and pure numbers need no escaping.
 
 import dataclasses
 import json as _json
+from collections.abc import Callable
 from enum import StrEnum
 from pathlib import Path
 
@@ -318,6 +319,40 @@ def _resolve_cli_fqn(store: SQLiteStore, target: str, kind: str) -> str:
     return resolution.resolved
 
 
+def _tree_neighbours(
+    store: SQLiteStore,
+    edges: list[Edge],
+    neighbour_of: Callable[[Edge], str],
+    *,
+    allowed_edge_types: frozenset[EdgeType] | None,
+    show_external: bool,
+    min_confidence: float | None,
+) -> list[tuple[str, Node | None]]:
+    """The neighbours one tree level shows: filtered, in edge order, each id once.
+
+    One entry per neighbour, not per edge: two call sites are separate edges to the
+    same node, and a tree row shows neither line nor edge type to tell them apart
+    (#463). A neighbour absent from the store (an unresolved target) comes back with
+    ``None``, and is dropped with the non-INTERNAL ones when ``show_external`` is off.
+    """
+    if allowed_edge_types is not None:
+        edges = [e for e in edges if e.type in allowed_edge_types]
+    if min_confidence is not None:
+        edges = [e for e in edges if e.confidence >= min_confidence]
+    ids = list(dict.fromkeys(neighbour_of(e) for e in edges))
+    nodes = {n.id: n for n in store.get_nodes(ids)}
+    return [
+        (node_id, nodes.get(node_id))
+        for node_id in ids
+        if show_external or _is_internal(nodes.get(node_id))
+    ]
+
+
+def _is_internal(node: Node | None) -> bool:
+    """True for a stored node from the ingested repository."""
+    return node is not None and node.namespace == NodeNamespace.INTERNAL
+
+
 def build_trace_tree(
     store: SQLiteStore,
     current_id: str,
@@ -333,21 +368,15 @@ def build_trace_tree(
     if current_depth >= max_depth:
         return
 
-    outgoing = store.get_outgoing_edges(current_id)
-    if allowed_edge_types is not None:
-        outgoing = [e for e in outgoing if e.type in allowed_edge_types]
-    if min_confidence is not None:
-        outgoing = [e for e in outgoing if e.confidence >= min_confidence]
-    nodes_map = {n.id: n for n in store.get_nodes([e.target for e in outgoing])}
-    for edge in outgoing:
-        target_id = edge.target
-        target_node = nodes_map.get(target_id)
-
-        if not show_external and (
-            target_node is None or target_node.namespace != NodeNamespace.INTERNAL
-        ):
-            continue
-
+    callees = _tree_neighbours(
+        store,
+        store.get_outgoing_edges(current_id),
+        lambda edge: edge.target,
+        allowed_edge_types=allowed_edge_types,
+        show_external=show_external,
+        min_confidence=min_confidence,
+    )
+    for target_id, target_node in callees:
         if target_node:
             label = (
                 f"[bold green]{target_node.type.value}[/bold green] "
@@ -470,21 +499,15 @@ def build_impact_tree(
     if current_depth >= max_depth:
         return
 
-    incoming = store.get_incoming_edges(current_id)
-    if allowed_edge_types is not None:
-        incoming = [e for e in incoming if e.type in allowed_edge_types]
-    if min_confidence is not None:
-        incoming = [e for e in incoming if e.confidence >= min_confidence]
-    nodes_map = {n.id: n for n in store.get_nodes([e.source for e in incoming])}
-    for edge in incoming:
-        source_id = edge.source
-        source_node = nodes_map.get(source_id)
-
-        if not show_external and (
-            source_node is None or source_node.namespace != NodeNamespace.INTERNAL
-        ):
-            continue
-
+    callers = _tree_neighbours(
+        store,
+        store.get_incoming_edges(current_id),
+        lambda edge: edge.source,
+        allowed_edge_types=allowed_edge_types,
+        show_external=show_external,
+        min_confidence=min_confidence,
+    )
+    for source_id, source_node in callers:
         if source_node:
             label = (
                 f"[bold magenta]{source_node.type.value}[/bold magenta] "

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/src/cgis/query/render/graph_json.py

@@ -28,6 +28,10 @@ def graph_to_json(
     ``coverage`` is the traversal's local resolution coverage (#201). A
     structure query follows no calls and passes none, so the key is omitted
     rather than reported as a zero it did not measure.
+
+    Edges are one per distinct ``(src, type, dst)``, as in the Mermaid view: two
+    call sites to the same function are separate graph edges, but without a line
+    number the payload would state the same fact twice (#463).
     """
     payload: dict[str, Any] = {
         "root": root,
@@ -40,16 +44,26 @@ def graph_to_json(
             }
             for node in nodes
         ],
-        "edges": [
-            {
+        "edges": _distinct_edges(edges),
+    }
+    if coverage is not None:
+        payload["coverage"] = coverage.model_dump()
+    return payload
+
+
+def _distinct_edges(edges: list[Edge]) -> list[dict[str, Any]]:
+    """Collapse edges sharing ``(src, type, dst)``, first-seen order, highest confidence kept."""
+    distinct: dict[tuple[str, str, str], dict[str, Any]] = {}
+    for edge in edges:
+        key = (edge.source, edge.type.value, edge.target)
+        seen = distinct.get(key)
+        if seen is None:
+            distinct[key] = {
                 "src": edge.source,
                 "dst": edge.target,
                 "type": edge.type.value,
                 "confidence": edge.confidence,
             }
-            for edge in edges
-        ],
-    }
-    if coverage is not None:
-        payload["coverage"] = coverage.model_dump()
-    return payload
+        elif edge.confidence > seen["confidence"]:
+            seen["confidence"] = edge.confidence
+    return list(distinct.values())

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/tests/unit/test_cli.py

@@ -162,6 +162,101 @@ def test_trace_renders_callees_in_tree(tmp_path: Path) -> None:
     assert "callee" in result.output
 
 
+_REPEATED_CALLS = """\
+def leaf(): pass
+
+def target():
+    leaf()
+    leaf()
+
+def caller():
+    target()
+    target()
+
+def top():
+    caller()
+"""
+
+
+def _repeated_calls_db(tmp_path: Path) -> str:
+    """caller calls target from two lines, target calls leaf from two lines (#463)."""
+    (tmp_path / "funcs.py").write_text(_REPEATED_CALLS, encoding="utf-8")
+    db_file = tmp_path / "graph.db"
+    result = runner.invoke(app, ["ingest", str(tmp_path), "--output", str(db_file)])
+    assert result.exit_code == 0
+    return str(db_file)
+
+
+def test_impact_tree_lists_each_caller_once(tmp_path: Path) -> None:
+    """Two call sites are one caller: one row, and its own callers expanded once (#463)."""
+    db = _repeated_calls_db(tmp_path)
+    result = runner.invoke(
+        app, ["impact", "funcs.target", "--db", db, "--depth", "2"], env={"COLUMNS": "200"}
+    )
+    assert result.exit_code == 0
+    assert result.output.count("FUNCTION funcs.caller ") == 1
+    assert result.output.count("FUNCTION funcs.top ") == 1
+
+
+def test_trace_tree_lists_each_callee_once(tmp_path: Path) -> None:
+    """Two call sites are one callee: one row, and its own callees expanded once (#463)."""
+    db = _repeated_calls_db(tmp_path)
+    result = runner.invoke(
+        app, ["trace", "funcs.caller", "--db", db, "--depth", "2"], env={"COLUMNS": "200"}
+    )
+    assert result.exit_code == 0
+    assert result.output.count("FUNCTION funcs.target ") == 1
+    assert result.output.count("FUNCTION funcs.leaf ") == 1
+
+
+_DIAMOND = """\
+def leaf(): pass
+
+def a():
+    leaf()
+
+def b():
+    leaf()
+
+def top():
+    a()
+    b()
+"""
+
+
+def test_trees_keep_a_node_reached_through_two_parents(tmp_path: Path) -> None:
+    """Dedup is per parent: leaf under both a and b, top above both (#463 review).
+
+    A dedup set shared across the recursion would print leaf once and silently drop
+    the second path — on cgis's own graph that loses 73 of 133 trace rows.
+    """
+    (tmp_path / "funcs.py").write_text(_DIAMOND, encoding="utf-8")
+    db = str(tmp_path / "graph.db")
+    assert runner.invoke(app, ["ingest", str(tmp_path), "--output", db]).exit_code == 0
+    env = {"COLUMNS": "200"}
+
+    trace = runner.invoke(app, ["trace", "funcs.top", "--db", db, "--depth", "2"], env=env)
+    assert trace.exit_code == 0
+    assert trace.output.count("FUNCTION funcs.leaf ") == 2
+
+    impact = runner.invoke(app, ["impact", "funcs.leaf", "--db", db, "--depth", "2"], env=env)
+    assert impact.exit_code == 0
+    assert impact.output.count("FUNCTION funcs.top ") == 2
+
+
+@pytest.mark.parametrize(
+    ("command", "root"), [("impact", "funcs.target"), ("trace", "funcs.caller")]
+)
+def test_json_traversal_emits_each_edge_once(tmp_path: Path, command: str, root: str) -> None:
+    """Repeated call sites collapse to one (src, type, dst) edge, as in mermaid (#463)."""
+    db = _repeated_calls_db(tmp_path)
+    result = runner.invoke(app, [command, root, "--db", db, "--depth", "2", "--format", "json"])
+    assert result.exit_code == 0
+    edges = [(e["src"], e["type"], e["dst"]) for e in json.loads(result.stdout)["edges"]]
+    assert len(edges) == len(set(edges))
+    assert ("funcs.caller", "CALLS", "funcs.target") in edges
+
+
 def test_trace_shows_unresolved_external_call(tmp_path: Path) -> None:
     """Calls to built-ins not in the graph are labelled as Unresolved."""
     (tmp_path / "mod.py").write_text("def greet(): print('hi')\n", encoding="utf-8")
@@ -185,6 +280,19 @@ def test_trace_shows_unresolved_external_call(tmp_path: Path) -> None:
     assert "print" in result.output
 
 
+def test_trace_hides_external_calls_by_default(tmp_path: Path) -> None:
+    """Without --show-external the stdlib callee is filtered out of the tree."""
+    (tmp_path / "mod.py").write_text("def greet(): print('hi')\n", encoding="utf-8")
+    db_file = tmp_path / "graph.db"
+    runner.invoke(app, ["ingest", str(tmp_path), "--output", str(db_file)])
+
+    result = runner.invoke(app, ["trace", "mod.greet", "--db", str(db_file)])
+
+    assert result.exit_code == 0
+    assert "Tracing execution flow" in result.output
+    assert "print" not in result.output
+
+
 def test_trace_min_confidence_hides_low_conf_calls(tmp_path: Path) -> None:
     """--min-confidence hides low-confidence (unresolved/raw_call) edges from the tree (#112)."""
     (tmp_path / "mod.py").write_text("def greet(): print('hi')\n", encoding="utf-8")

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/tests/unit/test_graph_json.py

@@ -89,3 +89,18 @@ def test_graph_to_json_omits_coverage_when_none() -> None:
     payload = graph_to_json("pkg.a", [_make_node("pkg.a")], [])
 
     assert "coverage" not in payload
+
+
+def test_graph_to_json_collapses_edges_with_the_same_endpoints_and_type() -> None:
+    """Two call sites are indistinguishable in the payload — emit one edge, highest confidence."""
+    nodes = [_make_node("pkg.a"), _make_node("pkg.b")]
+    first = _make_edge("pkg.a", "pkg.b", confidence=0.4)
+    second = first.model_copy(update={"id": "pkg.a->pkg.b@2", "confidence": 0.9})
+    other_type = _make_edge("pkg.a", "pkg.b", EdgeType.REFERENCES).model_copy(
+        update={"id": "pkg.a->pkg.b@ref"}
+    )
+    payload = graph_to_json("pkg.a", nodes, [first, second, other_type])
+    assert payload["edges"] == [
+        {"src": "pkg.a", "dst": "pkg.b", "type": "CALLS", "confidence": 0.9},
+        {"src": "pkg.a", "dst": "pkg.b", "type": "REFERENCES", "confidence": 1.0},
+    ]

{codegraph_brain-0.23.1 → codegraph_brain-0.23.2}/uv.lock

@@ -261,7 +261,7 @@ wheels = [
 
 [[package]]
 name = "codegraph-brain"
-version = "0.23.1"
+version = "0.23.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

codegraph_brain-0.23.1/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.23.1"
-}