codegraph-brain 0.23.1__tar.gz → 0.23.3__tar.gz

codegraph_brain-0.23.3/.github/workflows/mcp-registry.yml

@@ -0,0 +1,81 @@
+name: Publish to MCP Registry
+
+# A separate workflow file, not a job in release-please.yml: PyPI trusted
+# publishing is bound to that file, so nothing here can mint a PyPI upload token
+# whatever the publisher's environment restriction is (#471).
+#
+# Runs after every Release Please run and publishes only a tagged version the
+# registry does not list yet (scripts/mcp_registry_gate.sh), so ordinary pushes
+# to main are no-ops.
+#
+# A failed Release Please run (PyPI publish or relock) skips this workflow: the
+# red run is the signal. Recover with "Re-run failed jobs" there, or dispatch
+# this workflow on main.
+on:
+  workflow_run:
+    workflows: ["Release Please"]
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: mcp-registry
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish server.json
+    # Dispatch only from main, so an older branch can't publish its own server.json.
+    # The repository check is defence in depth: Release Please never runs for forks.
+    if: >-
+      (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
+      (github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # OIDC for `mcp-publisher login github-oidc`: no stored registry secret.
+      id-token: write
+    env:
+      # Pinned and checksum-verified: this job holds a registry identity, so it must
+      # not run whatever `releases/latest` happens to be. Bump both together; a
+      # binary too old for the registry fails login with "invalid audience".
+      MCP_PUBLISHER_VERSION: "1.8.1"
+      MCP_PUBLISHER_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
+    steps:
+      - name: Checkout the released commit
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+          persist-credentials: false
+
+      - name: Decide whether to publish
+        id: gate
+        run: bash scripts/mcp_registry_gate.sh check >> "$GITHUB_OUTPUT"
+
+      - name: Wait for the version on PyPI
+        if: steps.gate.outputs.publish == 'true'
+        run: bash scripts/mcp_registry_gate.sh wait-pypi
+
+      - name: Install mcp-publisher
+        if: steps.gate.outputs.publish == 'true'
+        run: |
+          set -euo pipefail
+          url="https://github.com/modelcontextprotocol/registry/releases/download/v${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz"
+          curl --proto '=https' --tlsv1.2 -fsSL "$url" -o mcp-publisher.tar.gz
+          echo "${MCP_PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum --check --strict
+          tar -xzf mcp-publisher.tar.gz mcp-publisher
+
+      - name: Validate server.json
+        if: steps.gate.outputs.publish == 'true'
+        run: ./mcp-publisher validate
+
+      - name: Log in with GitHub OIDC
+        if: steps.gate.outputs.publish == 'true'
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish
+        if: steps.gate.outputs.publish == 'true'
+        run: ./mcp-publisher publish

codegraph_brain-0.23.3/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.23.3"
+}

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.23.3](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.23.2...codegraph-brain-v0.23.3) (2026-09-17)
+
+
+### Documentation
+
+* auto-sync architecture graph and MCP reference ([#480](https://github.com/zaebee/codegraph-brain/issues/480)) ([5379cce](https://github.com/zaebee/codegraph-brain/commit/5379cce927b5fade5e2371503a0cd9e1f8041fc7))
+* **mcp:** say when to use each overlapping graph tool ([#477](https://github.com/zaebee/codegraph-brain/issues/477)) ([f33d764](https://github.com/zaebee/codegraph-brain/commit/f33d764ebdf217359964347aaa1137dc18ced513))
+
+## [0.23.2](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.23.1...codegraph-brain-v0.23.2) (2026-09-17)
+
+
+### Bug Fixes
+
+* **cli:** impact/trace list each neighbour once, JSON each edge once ([#475](https://github.com/zaebee/codegraph-brain/issues/475)) ([9c93b4b](https://github.com/zaebee/codegraph-brain/commit/9c93b4ba5748f99fe2aeb43d698c9d9628e6295a))
+
 ## [0.23.1](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.23.0...codegraph-brain-v0.23.1) (2026-09-17)
 
 

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: codegraph-brain
-Version: 0.23.1
+Version: 0.23.3
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/docs/how-to/MCP_REFERENCE.md

@@ -7,9 +7,16 @@
 
 ## `cgis_analyze_impact`
 
-Analyse transitive upstream callers of a specific FQN.
+Upstream subgraph of one FQN: everything that reaches it within ``depth`` hops.
 
-    Answers "what breaks if I change X?". ``output_format="mermaid"`` (default)
+    Every edge type counts — callers, but also importers, subclasses, type
+    references, DI dependents and the enclosing class or file — so this answers
+    "what breaks if I change X?". For what X depends on use
+    ``cgis_trace_flow``; for only the members of a module or class,
+    ``cgis_get_structure``; for a source-included brief to read before editing
+    one symbol, ``cgis_context``.
+
+    ``output_format="mermaid"`` (default)
     returns a diagram; ``"json"`` returns a joinable ``{root, nodes, edges,
     coverage}`` payload with real FQNs — letting an agent compute set
     differences (e.g. "which route handlers never reach ``verify_ownership``?")
@@ -22,14 +29,14 @@ Analyse transitive upstream callers of a specific FQN.
 | :--- | :--- | :---: | :--- |
 | `fqn` | `string` | ✓ | Fully qualified name, e.g. pkg.module.Class.method. A unique dot-boundary suffix also resolves; an ambiguous one returns candidates. Use cgis_find_symbol to look a name up. |
 | `db_path` | `string` |  | SQLite graph built by cgis_ingest. A relative path resolves against the MCP server's working directory, not the agent's — prefer an absolute path. |
-| `depth` | `integer` |  | Maximum edge hops upstream. Every edge type counts as a hop — CALLS, but also IMPORTS, CONTAINS and REFERENCES — so modules importing the target and the file containing it appear alongside its callers. |
+| `depth` | `integer` |  | Maximum edge hops upstream. Every edge type counts as a hop — callers, importers, subclasses, type references, DI dependents and the enclosing class or file all appear alongside each other. |
 | `output_format` | `string` |  | "mermaid" for a diagram, or "json" for a payload with real FQNs (case-insensitive). Any other value returns an error. |
 
 ---
 
 ## `cgis_audit_reachability`
 
-Reachability/authorization audit — which sources never reach a checkpoint (#172).
+Reachability/authorization audit — which sources never reach a checkpoint.
 
     The headline use is **IDOR/authz coverage**: list every route handler that does
     NOT transitively reach an ownership check. Reachability follows behavioral edges
@@ -56,7 +63,14 @@ Reachability/authorization audit — which sources never reach a checkpoint (#17
 
 ## `cgis_context`
 
-Compile an agent-facing GraphRAG context package for a focal FQN (#19).
+Prompt-ready brief on one FQN: its source, class, direct callers and callees.
+
+    Call this before editing a symbol, instead of reading its files. It follows
+    calls only, one hop by default. Source is included when the file is found
+    (see ``source_root``), and the domain when the graph was tagged with one.
+    For a multi-hop subgraph
+    over every edge type without source, use ``cgis_trace_flow`` (downstream) or
+    ``cgis_analyze_impact`` (upstream).
 
     Returns an XML-tagged prompt — the focal node's source, its enclosing class,
     its architectural domain boundary, direct callers (upstream ripple) and
@@ -115,7 +129,7 @@ Report per-domain architectural drift against declared ideal patterns.
 
 ## `cgis_find_orphans`
 
-Classes nothing in production builds, extends or names — dead-code candidates (#415).
+Classes nothing in production builds, extends or names — dead-code candidates.
 
     Finds classes that no test, type checker or linter flags, because each is
     still imported somewhere: a package re-export keeps a class importable long
@@ -209,10 +223,13 @@ Report the motif census across the repository's structural tiers.
 
 ## `cgis_get_structure`
 
-Show the structural layout (CONTAINS/DECLARES) of a module or class.
+Members of a module or class: the classes, functions and methods it contains.
 
-    Traverses only containment edges — no call-graph noise — matching the CLI
-    ``structure`` command. ``output_format="mermaid"`` (default) returns a
+    Follows containment (CONTAINS/DECLARES) only, so no call or import appears.
+    For how the code connects use ``cgis_trace_flow`` (what it depends on) or
+    ``cgis_analyze_impact`` (what depends on it).
+
+    Matches the CLI ``structure`` command. ``output_format="mermaid"`` (default) returns a
     diagram of the hierarchy rooted at the given FQN; ``"json"`` returns the
     joinable ``{root, nodes, edges}`` payload with real FQNs.
 
@@ -275,7 +292,7 @@ Propose a starter patterns.yaml from the measured graph (read-only).
 
 ## `cgis_metrics`
 
-Whole-graph architectural metrics — coupling bottlenecks + God classes (#16).
+Whole-graph architectural metrics — coupling bottlenecks, God classes, PageRank.
 
     Returns JSON ``{bottlenecks, god_classes, critical}`` computed with vectorized
     DuckDB aggregations over the whole graph (fan-in/fan-out coupling,
@@ -331,7 +348,15 @@ Suggest sub-package boundaries for a package from its dependency communities.
 
 ## `cgis_trace_flow`
 
-Trace the execution call-graph starting from a specific FQN downwards.
+Downstream subgraph of one FQN: everything it reaches within ``depth`` hops.
+
+    Every edge type counts — calls, imports, inheritance, DI dependencies,
+    references, and containment (so from a module or class the first hop includes
+    its own members) — so this answers "what does X depend on?". For what depends
+    on X use
+    ``cgis_analyze_impact``; for only the members of a module or class,
+    ``cgis_get_structure``; for a source-included brief to read before editing
+    one symbol, ``cgis_context``.
 
     ``output_format="mermaid"`` (default) returns a human-readable diagram;
     ``"json"`` returns a joinable ``{root, nodes, edges, coverage}`` payload
@@ -346,7 +371,7 @@ Trace the execution call-graph starting from a specific FQN downwards.
 | :--- | :--- | :---: | :--- |
 | `fqn` | `string` | ✓ | Fully qualified name, e.g. pkg.module.Class.method. A unique dot-boundary suffix also resolves; an ambiguous one returns candidates. Use cgis_find_symbol to look a name up. |
 | `db_path` | `string` |  | SQLite graph built by cgis_ingest. A relative path resolves against the MCP server's working directory, not the agent's — prefer an absolute path. |
-| `depth` | `integer` |  | Maximum edge hops downstream. Every edge type counts as a hop — CALLS, but also IMPORTS, CONTAINS and REFERENCES — so from a module the first hops are mostly imports and structure. |
+| `depth` | `integer` |  | Maximum edge hops downstream. Every edge type counts as a hop — calls, imports, inheritance, DI dependencies, references and containment — so from a module or class the first hop is mostly its own members and imports. |
 | `output_format` | `string` |  | "mermaid" for a diagram, or "json" for a payload with real FQNs (case-insensitive). Any other value returns an error. |
 
 ---

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.23.1"
+version = "0.23.3"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"

codegraph_brain-0.23.3/scripts/mcp_registry_gate.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Decide whether server.json's version should be published to the MCP Registry,
+# and wait until PyPI can back it (#471).
+#
+#   scripts/mcp_registry_gate.sh check     → prints publish=true|false (for $GITHUB_OUTPUT)
+#   scripts/mcp_registry_gate.sh wait-pypi → blocks until PyPI serves the version
+#
+# `check` is what makes the workflow safe to run after *every* Release Please run:
+# only a tagged release that the registry does not list yet is published, so a
+# docs push to main is a no-op and a re-run never double-publishes.
+#
+# Every lookup fails closed. `publish=false` is printed only on a definite answer
+# (no such tag, version already listed); a network error or an unexpected
+# response exits non-zero, because a silently skipped release is exactly what
+# this automation exists to prevent.
+#
+# `wait-pypi` exists because the registry verifies ownership by fetching
+# pypi.org/pypi/<pkg>/<version>/json and looking for the mcp-name marker, and a
+# fresh upload is not always visible there straight away (0.23.0 and 0.23.1 both
+# failed a `pip install` for a few minutes after the publish job went green).
+set -euo pipefail
+
+REGISTRY="${MCP_REGISTRY_URL:-https://registry.modelcontextprotocol.io}"
+PYPI="${PYPI_URL:-https://pypi.org}"
+TAG_PREFIX="${TAG_PREFIX:-codegraph-brain-v}"
+WAIT_SECONDS="${WAIT_SECONDS:-600}"
+POLL_SECONDS="${POLL_SECONDS:-15}"
+
+fail() {
+  echo "::error::$*" >&2
+  exit 1
+}
+
+read_field() {
+  local filter="$1" label="$2" value
+  value=$(jq -r "${filter} // empty" server.json) || fail "server.json is not valid JSON."
+  [[ -n "$value" ]] || fail "server.json has no ${label} (${filter})."
+  printf '%s' "$value"
+}
+
+name=$(read_field .name "server name")
+version=$(read_field .version "version")
+package=$(read_field 'first(.packages[]? | select(.registryType == "pypi") | .identifier)' "PyPI package")
+
+check() {
+  local tag="refs/tags/${TAG_PREFIX}${version}" rc=0
+  git ls-remote --exit-code --tags origin "$tag" >/dev/null || rc=$?
+  case "$rc" in
+    0) ;;
+    2)
+      echo "No tag ${TAG_PREFIX}${version}: not a release, nothing to publish." >&2
+      echo "publish=false"
+      return
+      ;;
+    *) fail "git ls-remote for ${tag} failed (exit ${rc}); cannot tell whether this is a release." ;;
+  esac
+
+  # The status alone is not enough: a moved API also answers 404, and a proxy can
+  # answer 200 with nothing. Each answer must also carry the body that means it.
+  local encoded body status
+  encoded=$(jq -rn --arg n "$name" '$n | @uri')
+  body=$(mktemp)
+  status=$(curl -sS -o "$body" -w '%{http_code}' \
+    "${REGISTRY}/v0/servers/${encoded}/versions/${version}") ||
+    fail "Registry lookup for ${name} ${version} failed."
+  if [[ "$status" == 200 ]] &&
+    jq -e --arg n "$name" --arg v "$version" \
+      '.server.name == $n and .server.version == $v' "$body" >/dev/null 2>&1; then
+    echo "${name} ${version} is already in the registry." >&2
+    echo "publish=false"
+  elif [[ "$status" == 404 ]] &&
+    jq -e '.detail == "Server not found"' "$body" >/dev/null 2>&1; then
+    echo "${name} ${version} is released and not in the registry yet." >&2
+    echo "publish=true"
+  else
+    fail "Unexpected registry answer for ${name} ${version}: HTTP ${status}, $(head -c 200 "$body")"
+  fi
+  rm -f "$body"
+}
+
+wait_pypi() {
+  local marker="mcp-name: ${name}" deadline=$((SECONDS + WAIT_SECONDS))
+  until curl -fsS "${PYPI}/pypi/${package}/${version}/json" 2>/dev/null |
+    jq -e --arg m "$marker" '(.info.description // "") | contains($m)' >/dev/null 2>&1; do
+    if [[ "$SECONDS" -ge "$deadline" ]]; then
+      fail "${package} ${version} with '${marker}' not on PyPI after ${WAIT_SECONDS}s." \
+        "Publish manually once it is: mcp-publisher login github && mcp-publisher publish"
+    fi
+    sleep "$POLL_SECONDS"
+  done
+  echo "${package} ${version} is on PyPI with the mcp-name marker." >&2
+}
+
+case "${1:-}" in
+  check) check ;;
+  wait-pypi) wait_pypi ;;
+  *)
+    echo "usage: $0 check|wait-pypi" >&2
+    exit 2
+    ;;
+esac

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/server.json

@@ -8,13 +8,13 @@
     "source": "github",
     "id": "1260843154"
   },
-  "version": "0.23.1",
+  "version": "0.23.3",
   "packages": [
     {
       "registryType": "pypi",
       "registryBaseUrl": "https://pypi.org",
       "identifier": "codegraph-brain",
-      "version": "0.23.1",
+      "version": "0.23.3",
       "runtimeHint": "uvx",
       "transport": {
         "type": "stdio"

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/src/cgis/api/mcp_server.py

@@ -364,13 +364,21 @@ def cgis_trace_flow(
         int,
         Field(
             description="Maximum edge hops downstream. Every edge type counts as a hop — "
-            "CALLS, but also IMPORTS, CONTAINS and REFERENCES — so from a module the first "
-            "hops are mostly imports and structure."
+            "calls, imports, inheritance, DI dependencies, references and containment — so "
+            "from a module or class the first hop is mostly its own members and imports."
         ),
     ] = 3,
     output_format: OutputFormat = "mermaid",
 ) -> str:
-    """Trace the execution call-graph starting from a specific FQN downwards.
+    """Downstream subgraph of one FQN: everything it reaches within ``depth`` hops.
+
+    Every edge type counts — calls, imports, inheritance, DI dependencies,
+    references, and containment (so from a module or class the first hop includes
+    its own members) — so this answers "what does X depend on?". For what depends
+    on X use
+    ``cgis_analyze_impact``; for only the members of a module or class,
+    ``cgis_get_structure``; for a source-included brief to read before editing
+    one symbol, ``cgis_context``.
 
     ``output_format="mermaid"`` (default) returns a human-readable diagram;
     ``"json"`` returns a joinable ``{root, nodes, edges, coverage}`` payload
@@ -417,15 +425,22 @@ def cgis_analyze_impact(
         int,
         Field(
             description="Maximum edge hops upstream. Every edge type counts as a hop — "
-            "CALLS, but also IMPORTS, CONTAINS and REFERENCES — so modules importing the "
-            "target and the file containing it appear alongside its callers."
+            "callers, importers, subclasses, type references, DI dependents and the "
+            "enclosing class or file all appear alongside each other."
         ),
     ] = 3,
     output_format: OutputFormat = "mermaid",
 ) -> str:
-    """Analyse transitive upstream callers of a specific FQN.
+    """Upstream subgraph of one FQN: everything that reaches it within ``depth`` hops.
+
+    Every edge type counts — callers, but also importers, subclasses, type
+    references, DI dependents and the enclosing class or file — so this answers
+    "what breaks if I change X?". For what X depends on use
+    ``cgis_trace_flow``; for only the members of a module or class,
+    ``cgis_get_structure``; for a source-included brief to read before editing
+    one symbol, ``cgis_context``.
 
-    Answers "what breaks if I change X?". ``output_format="mermaid"`` (default)
+    ``output_format="mermaid"`` (default)
     returns a diagram; ``"json"`` returns a joinable ``{root, nodes, edges,
     coverage}`` payload with real FQNs — letting an agent compute set
     differences (e.g. "which route handlers never reach ``verify_ownership``?")
@@ -471,10 +486,13 @@ def cgis_get_structure(
     ] = 2,
     output_format: OutputFormat = "mermaid",
 ) -> str:
-    """Show the structural layout (CONTAINS/DECLARES) of a module or class.
+    """Members of a module or class: the classes, functions and methods it contains.
 
-    Traverses only containment edges — no call-graph noise — matching the CLI
-    ``structure`` command. ``output_format="mermaid"`` (default) returns a
+    Follows containment (CONTAINS/DECLARES) only, so no call or import appears.
+    For how the code connects use ``cgis_trace_flow`` (what it depends on) or
+    ``cgis_analyze_impact`` (what depends on it).
+
+    Matches the CLI ``structure`` command. ``output_format="mermaid"`` (default) returns a
     diagram of the hierarchy rooted at the given FQN; ``"json"`` returns the
     joinable ``{root, nodes, edges}`` payload with real FQNs.
     """
@@ -785,7 +803,14 @@ def cgis_context(
         ),
     ] = "",
 ) -> str:
-    """Compile an agent-facing GraphRAG context package for a focal FQN (#19).
+    """Prompt-ready brief on one FQN: its source, class, direct callers and callees.
+
+    Call this before editing a symbol, instead of reading its files. It follows
+    calls only, one hop by default. Source is included when the file is found
+    (see ``source_root``), and the domain when the graph was tagged with one.
+    For a multi-hop subgraph
+    over every edge type without source, use ``cgis_trace_flow`` (downstream) or
+    ``cgis_analyze_impact`` (upstream).
 
     Returns an XML-tagged prompt — the focal node's source, its enclosing class,
     its architectural domain boundary, direct callers (upstream ripple) and
@@ -836,7 +861,7 @@ def cgis_metrics(
         ),
     ] = None,
 ) -> str:
-    """Whole-graph architectural metrics — coupling bottlenecks + God classes (#16).
+    """Whole-graph architectural metrics — coupling bottlenecks, God classes, PageRank.
 
     Returns JSON ``{bottlenecks, god_classes, critical}`` computed with vectorized
     DuckDB aggregations over the whole graph (fan-in/fan-out coupling,
@@ -894,7 +919,7 @@ def cgis_find_orphans(
         bool, Field(description="Include machine-generated classes, which are hidden by default.")
     ] = False,
 ) -> str:
-    """Classes nothing in production builds, extends or names — dead-code candidates (#415).
+    """Classes nothing in production builds, extends or names — dead-code candidates.
 
     Finds classes that no test, type checker or linter flags, because each is
     still imported somewhere: a package re-export keeps a class importable long
@@ -976,7 +1001,7 @@ def cgis_audit_reachability(
         Field(description="Maximum reachability depth; a longer path is reported as a gap."),
     ] = 5,
 ) -> str:
-    """Reachability/authorization audit — which sources never reach a checkpoint (#172).
+    """Reachability/authorization audit — which sources never reach a checkpoint.
 
     The headline use is **IDOR/authz coverage**: list every route handler that does
     NOT transitively reach an ownership check. Reachability follows behavioral edges

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/src/cgis/cli.py

@@ -20,6 +20,7 @@ style tags you wrote yourself and pure numbers need no escaping.
 
 import dataclasses
 import json as _json
+from collections.abc import Callable
 from enum import StrEnum
 from pathlib import Path
 
@@ -318,6 +319,40 @@ def _resolve_cli_fqn(store: SQLiteStore, target: str, kind: str) -> str:
     return resolution.resolved
 
 
+def _tree_neighbours(
+    store: SQLiteStore,
+    edges: list[Edge],
+    neighbour_of: Callable[[Edge], str],
+    *,
+    allowed_edge_types: frozenset[EdgeType] | None,
+    show_external: bool,
+    min_confidence: float | None,
+) -> list[tuple[str, Node | None]]:
+    """The neighbours one tree level shows: filtered, in edge order, each id once.
+
+    One entry per neighbour, not per edge: two call sites are separate edges to the
+    same node, and a tree row shows neither line nor edge type to tell them apart
+    (#463). A neighbour absent from the store (an unresolved target) comes back with
+    ``None``, and is dropped with the non-INTERNAL ones when ``show_external`` is off.
+    """
+    if allowed_edge_types is not None:
+        edges = [e for e in edges if e.type in allowed_edge_types]
+    if min_confidence is not None:
+        edges = [e for e in edges if e.confidence >= min_confidence]
+    ids = list(dict.fromkeys(neighbour_of(e) for e in edges))
+    nodes = {n.id: n for n in store.get_nodes(ids)}
+    return [
+        (node_id, nodes.get(node_id))
+        for node_id in ids
+        if show_external or _is_internal(nodes.get(node_id))
+    ]
+
+
+def _is_internal(node: Node | None) -> bool:
+    """True for a stored node from the ingested repository."""
+    return node is not None and node.namespace == NodeNamespace.INTERNAL
+
+
 def build_trace_tree(
     store: SQLiteStore,
     current_id: str,
@@ -333,21 +368,15 @@ def build_trace_tree(
     if current_depth >= max_depth:
         return
 
-    outgoing = store.get_outgoing_edges(current_id)
-    if allowed_edge_types is not None:
-        outgoing = [e for e in outgoing if e.type in allowed_edge_types]
-    if min_confidence is not None:
-        outgoing = [e for e in outgoing if e.confidence >= min_confidence]
-    nodes_map = {n.id: n for n in store.get_nodes([e.target for e in outgoing])}
-    for edge in outgoing:
-        target_id = edge.target
-        target_node = nodes_map.get(target_id)
-
-        if not show_external and (
-            target_node is None or target_node.namespace != NodeNamespace.INTERNAL
-        ):
-            continue
-
+    callees = _tree_neighbours(
+        store,
+        store.get_outgoing_edges(current_id),
+        lambda edge: edge.target,
+        allowed_edge_types=allowed_edge_types,
+        show_external=show_external,
+        min_confidence=min_confidence,
+    )
+    for target_id, target_node in callees:
         if target_node:
             label = (
                 f"[bold green]{target_node.type.value}[/bold green] "
@@ -470,21 +499,15 @@ def build_impact_tree(
     if current_depth >= max_depth:
         return
 
-    incoming = store.get_incoming_edges(current_id)
-    if allowed_edge_types is not None:
-        incoming = [e for e in incoming if e.type in allowed_edge_types]
-    if min_confidence is not None:
-        incoming = [e for e in incoming if e.confidence >= min_confidence]
-    nodes_map = {n.id: n for n in store.get_nodes([e.source for e in incoming])}
-    for edge in incoming:
-        source_id = edge.source
-        source_node = nodes_map.get(source_id)
-
-        if not show_external and (
-            source_node is None or source_node.namespace != NodeNamespace.INTERNAL
-        ):
-            continue
-
+    callers = _tree_neighbours(
+        store,
+        store.get_incoming_edges(current_id),
+        lambda edge: edge.source,
+        allowed_edge_types=allowed_edge_types,
+        show_external=show_external,
+        min_confidence=min_confidence,
+    )
+    for source_id, source_node in callers:
         if source_node:
             label = (
                 f"[bold magenta]{source_node.type.value}[/bold magenta] "

{codegraph_brain-0.23.1 → codegraph_brain-0.23.3}/src/cgis/query/render/graph_json.py

@@ -28,6 +28,10 @@ def graph_to_json(
     ``coverage`` is the traversal's local resolution coverage (#201). A
     structure query follows no calls and passes none, so the key is omitted
     rather than reported as a zero it did not measure.
+
+    Edges are one per distinct ``(src, type, dst)``, as in the Mermaid view: two
+    call sites to the same function are separate graph edges, but without a line
+    number the payload would state the same fact twice (#463).
     """
     payload: dict[str, Any] = {
         "root": root,
@@ -40,16 +44,26 @@ def graph_to_json(
             }
             for node in nodes
         ],
-        "edges": [
-            {
+        "edges": _distinct_edges(edges),
+    }
+    if coverage is not None:
+        payload["coverage"] = coverage.model_dump()
+    return payload
+
+
+def _distinct_edges(edges: list[Edge]) -> list[dict[str, Any]]:
+    """Collapse edges sharing ``(src, type, dst)``, first-seen order, highest confidence kept."""
+    distinct: dict[tuple[str, str, str], dict[str, Any]] = {}
+    for edge in edges:
+        key = (edge.source, edge.type.value, edge.target)
+        seen = distinct.get(key)
+        if seen is None:
+            distinct[key] = {
                 "src": edge.source,
                 "dst": edge.target,
                 "type": edge.type.value,
                 "confidence": edge.confidence,
             }
-            for edge in edges
-        ],
-    }
-    if coverage is not None:
-        payload["coverage"] = coverage.model_dump()
-    return payload
+        elif edge.confidence > seen["confidence"]:
+            seen["confidence"] = edge.confidence
+    return list(distinct.values())