codegraph-brain 0.6.0__tar.gz → 0.7.0__tar.gz

codegraph_brain-0.7.0/.claude-plugin/marketplace.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "codegraph-brain",
+  "description": "Code Graph Intelligence for AI agents — a deterministic semantic graph of your codebase, exposed as MCP tools.",
+  "owner": {
+    "name": "Andrey G",
+    "url": "https://github.com/zaebee"
+  },
+  "plugins": [
+    {
+      "name": "cgis",
+      "source": "./plugin",
+      "description": "Gives Claude a deterministic semantic graph of your codebase instead of flat text. Exact callers, real blast radius, and scoped context in a few hundred tokens rather than whole files.",
+      "version": "0.6.0",
+      "category": "development",
+      "author": {
+        "name": "Andrey G",
+        "url": "https://github.com/zaebee"
+      },
+      "homepage": "https://github.com/zaebee/codegraph-brain",
+      "tags": [
+        "code-graph",
+        "static-analysis",
+        "impact-analysis",
+        "architecture",
+        "python",
+        "typescript"
+      ]
+    }
+  ]
+}

codegraph_brain-0.7.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.0"
+}

{codegraph_brain-0.6.0 → codegraph_brain-0.7.0}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.7.0](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.6.0...codegraph-brain-v0.7.0) (2026-07-31)
+
+
+### Features
+
+* **plugin:** ship CGIS as a Claude Code plugin ([#290](https://github.com/zaebee/codegraph-brain/issues/290)) ([c93c7ed](https://github.com/zaebee/codegraph-brain/commit/c93c7ed377943081525c8965bc3a7ce5e5ccf7c1))
+
+
+### Documentation
+
+* **plugin:** disclose the PyPI fetch and the local-only guarantee ([#291](https://github.com/zaebee/codegraph-brain/issues/291)) ([278560c](https://github.com/zaebee/codegraph-brain/commit/278560c74d7d9deae076511ce8659c233c41bcfc))
+* **specs:** finder bug-class taxonomy + a real Resource Management fixture ([#258](https://github.com/zaebee/codegraph-brain/issues/258)) ([#288](https://github.com/zaebee/codegraph-brain/issues/288)) ([1e02d06](https://github.com/zaebee/codegraph-brain/commit/1e02d06a1599d87dbc4958cb6e6db6e0acaae605))
+
 ## [0.6.0](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.5.0...codegraph-brain-v0.6.0) (2026-07-31)
 
 

{codegraph_brain-0.6.0 → codegraph_brain-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraph-brain
-Version: 0.6.0
+Version: 0.7.0
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain
@@ -124,6 +124,19 @@ cgis impact "my_module.core_function" --depth 5
 
 ---
 
+## 🔌 Install as a Claude Code plugin
+
+The fastest path — no config files, no paths to wire up:
+
+```bash
+/plugin marketplace add zaebee/codegraph-brain
+/plugin install cgis@codegraph-brain
+```
+
+That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis-ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
+
+---
+
 ## 🤖 Agent Integration (MCP)
 
 CGIS is designed to be plugged into your AI workflow via the **Model Context Protocol (MCP)**. Once running, your agent gains "Superpowers":

{codegraph_brain-0.6.0 → codegraph_brain-0.7.0}/README.md

@@ -74,6 +74,19 @@ cgis impact "my_module.core_function" --depth 5
 
 ---
 
+## 🔌 Install as a Claude Code plugin
+
+The fastest path — no config files, no paths to wire up:
+
+```bash
+/plugin marketplace add zaebee/codegraph-brain
+/plugin install cgis@codegraph-brain
+```
+
+That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis-ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
+
+---
+
 ## 🤖 Agent Integration (MCP)
 
 CGIS is designed to be plugged into your AI workflow via the **Model Context Protocol (MCP)**. Once running, your agent gains "Superpowers":

{codegraph_brain-0.6.0 → codegraph_brain-0.7.0}/benchmarks/guardian/CURATION.md

@@ -172,7 +172,6 @@ Ambiguous (3 declined clips, gemini agreed with rationale):
 - **review_head = 6ee175e553c784a363c190e00021be5d365fb8dd** (later commits on
   the branch postdate the review)
 
-GT findings: NONE → recall vacuously 1.0; this PR measures precision only.
 Guardian returned 10 findings, all skeptic-confirmed, all refuted (#279):
 
 - `base.py:102` remove the "unreachable" `raise AssertionError` — **would break
@@ -189,3 +188,21 @@ Guardian returned 10 findings, all skeptic-confirmed, all refuted (#279):
   module has any; it is a plain dict → JSON
 - two test findings on brittle call counts — one's premise is false, the test
   already derives its expectation from `MAX_ATTEMPTS`
+
+### PR 278 — one GT finding added 2026-07-31 (#258)
+
+Originally filed with `findings: []` as a pure precision entry. It now carries one:
+
+- `gemini-client-never-closed` (`src/cgis/guardian/providers/gemini.py`, lines
+  41-58, minor, contract, source `fix-commit`)
+
+The diff **modified** the `client = genai.Client(...)` construction line and left
+both httpx pools unclosed. Guardian reviewed that hunk and returned ten findings,
+none about resource cleanup — Resource Management is a class absent from the
+finder's focus areas (see `docs/specs/2026-07-31-finder-bug-class-taxonomy.md`).
+Fixed later by human-directed review as #283 (`b2ae97b`), which is the
+`fix-commit` provenance.
+
+Precision is unaffected: `matched` stays 0, so the entry still scores `0/10`. The
+addition supplies a recall signal — a real **0/1** where the empty ground truth
+gave a vacuous 1.0.

codegraph_brain-0.7.0/benchmarks/guardian/pr-278.yaml

@@ -0,0 +1,22 @@
+# PR 278 — fix(guardian): explicit request timeout + bounded retry. See CURATION.md.
+# Guardian produced 10 findings, skeptic-confirmed 10/10, ALL refuted (#279).
+# head = review head (the snapshot guardian actually ran on); the two later
+# commits on that branch postdate the review.
+# One GT finding added 2026-07-31 (#258): the diff MODIFIED the genai.Client
+# construction line and left both httpx pools unclosed. Guardian saw that hunk
+# and returned 10 findings, none about resource cleanup — a class absent from
+# the finder's focus areas. Fixed later in #283 (b2ae97b).
+# Precision is unchanged by the addition (matched stays 0, so 0/10); what it adds
+# is a recall signal: 0/1 instead of a vacuous 1.0.
+pr: 278
+base: 2e768cef585f10481970697657b0a9b40a411f47
+head: 6ee175e553c784a363c190e00021be5d365fb8dd
+findings:
+  - id: gemini-client-never-closed
+    file: src/cgis/guardian/providers/gemini.py
+    lines: [41, 58]
+    severity: minor
+    category: contract
+    summary: genai.Client opens a sync and an async httpx pool; neither is closed
+    source: fix-commit
+ambiguous: []

codegraph_brain-0.7.0/docs/specs/2026-07-31-finder-bug-class-taxonomy.md

@@ -0,0 +1,155 @@
+# Finder bug-class taxonomy — gap analysis (#258)
+
+**Status:** research input, **nothing shipped** (2026-07-31)
+**Issue:** #258
+**Lane:** guardian
+
+## What this is, and what it deliberately is not
+
+#258 asks to broaden the finder's focus areas using
+[alibaba/open-code-review](https://github.com/alibaba/open-code-review) (Apache-2.0)
+as a source. This document does the mining and the gap analysis. It **does not
+change the prompt**, and the reason is in the evidence below: a taxonomy checklist
+is not a proven recall lever in this project, and the one adjacent experiment
+regressed a class the finder was reliably catching.
+
+What it produces instead is the two things that were missing before that decision
+can be made: a grounded class list, and a benchmark fixture that contains a real
+instance of the top gap.
+
+## The source
+
+The taxonomy lives in `internal/config/rules/rule_docs/*.md` — per-language rule
+documents, not a single ruleset file. Read `python.md` (language-specific) and
+`default.md` (language-agnostic axes).
+
+`default.md` gives five axes: **Correctness, Security, Performance,
+Maintainability, Test Coverage.**
+
+`python.md` names ten classes:
+
+| # | class | representative rules |
+|---|-------|----------------------|
+| 1 | Obvious Typos or Spelling Errors | misspellings at declaration sites, in log/exception strings |
+| 2 | Dead Code | unreachable branches, unread variables/imports, commented-out blocks |
+| 3 | Mutable Default Arguments and Shared State | `def f(x=[])`, class-level mutables, loop-variable closures |
+| 4 | Boundary and Edge-Case Handling | empty-collection indexing, off-by-one, `None` reaching non-optional code, **float `==`**, `d[k]` vs `d.get(k)` |
+| 5 | Error Handling and Exceptions | bare `except:`, over-broad `except Exception`, silently discarded exceptions, lost traceback, over-wide `try`, `assert` for runtime validation |
+| 6 | Identity and Equality Comparisons | `is` against literals, `== True`, `== None` |
+| 7 | **Resource Management** | files/sockets/locks/connections without `with`; **"resources acquired in a `try` whose `finally` cleanup is missing or incomplete on the error path"** |
+| 8 | Performance | `+=` string building, list membership tests, loop-invariant recomputation, eager f-strings in logging |
+| 9 | Concurrency and Async | check-then-act races, blocking calls inside `async def`, **asyncio tasks created and never awaited**, unsynchronised shared state |
+| 10 | Security-Sensitive Code | `eval`/`exec`, `subprocess(shell=True)`, `pickle`/`yaml.load` without SafeLoader, string-built SQL, secrets in logs, weak crypto, path traversal |
+
+## A framing incompatibility that must not be copied
+
+`python.md` opens with:
+
+> Favor precision over recall: only raise an issue when you are confident it is a
+> real defect, and stay silent when the surrounding context is unclear.
+
+That is the **opposite** of this project's finder, which was deliberately moved to
+the max-recall end in #249 (cap removed, confidence gate dropped, "surface every
+plausible finding") on the recall-then-filter architecture. Their rules also
+repeatedly instruct the model to *confirm with a file read before flagging* —
+an agentic capability our finder does not have.
+
+**Borrow the class names. Do not borrow the framing.** Lifting their preamble
+would undo #249.
+
+## Gap analysis against the current focus areas
+
+`prompts.py` currently names seven: Logic bugs, Unvalidated external data,
+Exact-equality on floats/money, Missing test coverage, Type safety, Library
+boundary contracts, Ontology compliance.
+
+Mapped against the source:
+
+| source class | our coverage |
+|---|---|
+| Boundary and Edge-Case Handling | **covered** — split across "Logic bugs" and "Exact-equality on floats" |
+| Test Coverage | **covered** — "Missing test coverage" |
+| Security-Sensitive Code | **absent** |
+| Concurrency and Async | **absent** |
+| Resource Management | **absent** |
+| Error Handling and Exceptions | **absent** |
+| Mutable Default Arguments | absent |
+| Identity and Equality Comparisons | absent |
+| Dead Code | absent |
+| Performance | absent |
+| — | "Type safety" and "Ontology compliance" are ours alone (mypy-strict and the cgis graph contract); no counterpart, and correctly so |
+
+### Four gaps have evidence in this repository, not just in the abstract
+
+- **Resource Management.** PR #278's diff *modified* the
+  `client = genai.Client(...)` line in `gemini.py` and left both httpx pools
+  unclosed. Guardian reviewed that hunk and returned 10 findings, none about
+  resource cleanup. Fixed later by human-directed review as #283. The source's
+  wording — cleanup "missing or incomplete on the error path" — even covers the
+  follow-on defect found in review of that fix, where a throwing `aclose()`
+  skipped `client.close()`.
+- **Error Handling and Exceptions.** The recording guard added in #279 was written
+  as `except Exception` and was too broad: it swallowed the `ValueError` a
+  mistyped path raises. Caught by an independent reviewer, not by the finder.
+- **Security-Sensitive Code.** This repo parses YAML (`load_ground_truth`,
+  `patterns.yaml`) and shells out to `git` and `gh` throughout `guardian_bench.py`
+  and `collector.py`. Two of the source's rules — `yaml.load` without `SafeLoader`,
+  `subprocess` with `shell=True` — target exactly those surfaces.
+- **Concurrency and Async.** The whole guardian path is async: providers, chunked
+  review, `judge_all`'s concurrency. "asyncio tasks created and never awaited" and
+  "blocking calls inside `async def`" are live risks here.
+
+The remaining four gaps (mutable defaults, identity comparisons, dead code,
+performance) have no observed instance in this codebase. They are candidates, not
+findings.
+
+## Why the prompt is not being changed here
+
+Two independent pieces of evidence:
+
+1. **The lever is unproven.** The deep-research synthesis behind #249 ranked levers
+   by vote; "refined checklist raised recall 0.66→0.93" was **killed 0-3**, and
+   "few-shot beats taxonomy+CoT" was also killed. The defect checklist was
+   explicitly demoted to "a light scaffold, NOT the main bet" — the main bets being
+   cap removal, the max-recall instruction, and sampling.
+2. **The adjacent experiment regressed.** Expanding few-shot with a targeted float
+   example did not crack the float class *and* dropped pr-144 from a median 3/5 to
+   1/5 — it pulled finder attention away from the yaml class it was catching
+   reliably. Reverted on no-evidence-no-ship (#247's over-anchoring lesson, which
+   #258 itself cites).
+
+A compact named-class checklist is a weaker intervention than the few-shot that
+burned us, so it may well be safe. But "may well be" is not a measurement, and
+this system has swung on single-finding deltas before.
+
+## What would make the change decidable
+
+#258 says to validate "once a suitable fixture exists". One now does:
+`benchmarks/guardian/pr-278.yaml` carries a real Resource Management defect
+(`gemini-client-never-closed`) that the current finder demonstrably missed, on a
+diff whose review head is pinned.
+
+Adding the ground truth does not disturb the precision baseline published in #279:
+`precision = matched / (matched + noise)` and matched stays 0, so it remains
+`0/10 = 0.0`. What it adds is a recall signal — a real **0/1** where an empty
+ground truth gave a vacuous 1.0.
+
+The experiment that decides #258:
+
+1. Freeze a finder set on pr-278 with `--record-finder` (no skeptic).
+2. Replay with the current prompt: expect recall 0.0 on that entry.
+3. Add the compact class checklist and re-run the frozen-set comparison across
+   pr-278 **and** the existing entries — the point is not only "does it catch the
+   leak" but "does it stop catching what it caught", which is how the float
+   experiment failed.
+4. Ship only if recall does not regress elsewhere.
+
+Steps 2–4 need a provider key, which is why they are not done here.
+
+## Out of scope
+
+- Any edit to `prompts.py`.
+- Adopting the source's precision-over-recall framing, or its file-read-before-flag
+  instructions (we have no such capability in the finder).
+- Copying rule text verbatim — the source is Apache-2.0 Go/agentic tooling for a
+  different stack; #258 asks for the taxonomy only.

codegraph_brain-0.7.0/plugin/.claude-plugin/plugin.json

@@ -0,0 +1,22 @@
+{
+  "name": "cgis",
+  "displayName": "CGIS — Code Graph Intelligence",
+  "version": "0.6.0",
+  "description": "Gives Claude a deterministic semantic graph of your codebase instead of flat text — exact callers, real blast radius, and scoped context in a few hundred tokens rather than whole files. Runs fully locally: on first use it fetches the open-source codegraph-brain package from PyPI via uvx, then analyses your code on your machine. No hooks, no telemetry, nothing sent anywhere.",
+  "author": {
+    "name": "Andrey G",
+    "url": "https://github.com/zaebee"
+  },
+  "homepage": "https://github.com/zaebee/codegraph-brain",
+  "repository": "https://github.com/zaebee/codegraph-brain",
+  "license": "MIT",
+  "keywords": [
+    "code-graph",
+    "static-analysis",
+    "impact-analysis",
+    "call-graph",
+    "architecture",
+    "python",
+    "typescript"
+  ]
+}

codegraph_brain-0.7.0/plugin/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "cgis": {
+      "command": "uvx",
+      "args": ["--from", "codegraph-brain>=0.6.0", "cgis-mcp"]
+    }
+  }
+}

codegraph_brain-0.7.0/plugin/README.md

@@ -0,0 +1,44 @@
+# CGIS — Code Graph Intelligence
+
+Gives Claude a deterministic semantic graph of your codebase instead of flat text. Exact callers, real blast radius, and scoped context in a few hundred tokens rather than whole files.
+
+```bash
+/plugin marketplace add zaebee/codegraph-brain
+/plugin install cgis@codegraph-brain
+```
+
+Then, in any repository, run `/cgis-ingest` once to build the graph.
+
+## What it ships
+
+| Component | What it does |
+| :--- | :--- |
+| MCP server `cgis` | 13 tools: impact analysis, flow tracing, structure, symbol search, metrics, architectural drift, authz reachability |
+| Skill `cgis` | Teaches the agent *when* to query the graph instead of reading files |
+| Command `/cgis-ingest` | Builds the graph on first use and reports what it found |
+
+## What it does on your machine
+
+**On first use it downloads a package.** The MCP server is the open-source [`codegraph-brain`](https://pypi.org/project/codegraph-brain/) package (MIT), fetched from PyPI with `uvx --from "codegraph-brain>=0.6.0" cgis-mcp` and cached by `uv` afterwards. That download is the only thing this plugin fetches.
+
+**Everything else is local.** Your source code is parsed on your machine with Tree-sitter, and the resulting graph is written to `graph.db` in your project root. No source, no graph, and no usage data leaves your machine.
+
+- **No hooks.** The plugin registers none, so it observes nothing outside its own tool calls.
+- **No telemetry.** No analytics, usage pings, crash reporting or feature-flag fetches.
+- **No credential access.** It reads source files under the path you point it at; nothing else.
+
+`graph.db` should go in your `.gitignore`.
+
+## Guardian is not part of this plugin
+
+The repository also contains **Guardian**, a graph-aware LLM code reviewer that *does* call an external model provider (Gemini, Mistral, Cohere, or a local Ollama). It is a CI tool, it requires explicit configuration, and this plugin neither ships nor invokes it. See the [repository README](https://github.com/zaebee/codegraph-brain#-guardian-graph-aware-code-review) if you want it in your pipeline.
+
+## Coverage
+
+Extractors exist for **Python** and **TypeScript** (`.py`, `.ts`, `.tsx`). Other languages are invisible to the graph — see the [case study](https://github.com/zaebee/codegraph-brain/blob/main/docs/CASE_STUDY.md) for measured coverage on a real twelve-repository codebase, including what it misses.
+
+## Links
+
+- Source: [github.com/zaebee/codegraph-brain](https://github.com/zaebee/codegraph-brain)
+- Package: [pypi.org/project/codegraph-brain](https://pypi.org/project/codegraph-brain/)
+- Licence: MIT

codegraph_brain-0.7.0/plugin/commands/cgis-ingest.md

@@ -0,0 +1,28 @@
+---
+description: Build or refresh the CGIS code graph for this repository
+argument-hint: "[source path — defaults to autodetected]"
+---
+
+Build the CGIS semantic graph for this repository so the `cgis_*` tools can answer structural questions.
+
+**Source path:** $ARGUMENTS
+
+If no path was given above, work out the source root yourself rather than asking:
+
+- a `src/` directory if one exists
+- otherwise the package directory named in `pyproject.toml`, `package.json`, or `tsconfig.json`
+- otherwise the repository root
+
+Never point ingestion at `node_modules`, `.venv`, `venv`, `dist`, `build`, or `.git` — they add minutes and pollute the graph with code nobody will ask about.
+
+Then:
+
+1. Call `cgis_ingest` with that path. Leave `db_path` at its default so the graph lands in `graph.db` at the project root, where every other tool looks for it.
+2. Call `cgis_validate` and read the resolution breakdown.
+3. Report back concisely: how many files, nodes and edges landed, and the share of unresolved edges.
+
+On the unresolved share, interpret rather than just quoting the number. A residue in the low tens of percent is normal and consists mostly of runtime-dispatched calls — `logger.info`, `response.json`, injected clients. If it is unusually high, the likely cause is ingesting the wrong root or a codebase leaning heavily on dynamic dispatch; say which you think it is.
+
+If the repository contains languages CGIS has no extractor for — anything other than Python and TypeScript — name them, so it is clear up front which parts of the codebase the graph will not be able to answer for.
+
+Finally, mention that `graph.db` should be added to `.gitignore` if it is not already there, and that the graph goes stale as code changes: re-run this command after substantial edits.

codegraph_brain-0.7.0/plugin/skills/cgis/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: cgis
+description: Use when a question is about how code connects rather than what a single file says — finding every caller of a symbol, judging whether a rename or signature change is safe, tracing an execution path, mapping an unfamiliar module, or checking architectural drift. Reach for it before grepping across files or reading whole modules for context.
+---
+
+# CGIS — query the graph instead of guessing
+
+Reading files to answer a structural question is the slow, lossy path: it burns context and still leaves you inferring connections. CGIS holds a deterministic graph of the codebase — every function, method, class and the resolved edges between them — and answers those questions exactly.
+
+## When to reach for it
+
+| Question | Tool | Instead of |
+| :--- | :--- | :--- |
+| "What calls this?" | `cgis_analyze_impact` | grepping the name and hoping |
+| "Is this rename safe?" | `cgis_analyze_impact` | reading every plausible caller |
+| "What does this end up calling?" | `cgis_trace_flow` | following imports by hand |
+| "How is this class laid out?" | `cgis_get_structure` | reading the whole file |
+| "Give me context on this symbol" | `cgis_context` | pasting several files |
+| "Where is the symbol named X?" | `cgis_find_symbol` | a broad grep |
+| "What's coupled or god-classed?" | `cgis_metrics` | intuition |
+| "Did this change drift the architecture?" | `cgis_drift` | nothing — there is no manual equivalent |
+| "Does every handler reach its authz guard?" | `cgis_audit_reachability` | auditing routes one by one |
+
+A subgraph at depth 2 costs a few hundred tokens. The equivalent in file chunks costs thousands and is less precise.
+
+## First run in a repository
+
+The graph lives in `graph.db` in the project root, and every tool resolves that path relative to the working directory. If a tool answers `Database not found`, the graph has not been built yet:
+
+```
+cgis_ingest(project_path="./src")
+```
+
+Point it at the source root, not the repository root — ingesting `node_modules` or a virtualenv wastes time and pollutes the graph. `/cgis-ingest` does this for you and picks the right path.
+
+Re-run `cgis_ingest` after any substantial change; it is incremental by default and skips unchanged files. A stale graph is worse than no graph, because it answers confidently and wrongly.
+
+## Reading the answers honestly
+
+CGIS classifies each edge as **internal**, **stdlib**, **external**, or **unresolved**. Unresolved edges are not bugs — they are calls on objects whose type is decided at runtime (`response.json`, `logger.info`, an injected client). No static analyser resolves those without executing the code.
+
+This matters when you act on the output: **an empty impact result means "no static callers found", not "safe to delete."** A symbol reached only through dynamic dispatch, a registry, or a framework decorator will not appear. Check `cgis_validate` if the unresolved share looks high for the area you are touching, and say so rather than asserting safety you cannot see.
+
+## Coverage
+
+Extractors exist for **Python** (`.py`) and **TypeScript** (`.ts`, `.tsx`). Vue, Astro, Go, Rust and everything else are invisible to the graph — in a mixed repository, fall back to reading files for those parts and say which parts of the answer the graph could not cover.
+
+## Not covered here
+
+Guardian, the graph-aware LLM reviewer, is a CI tool rather than an interactive one — it reviews pull requests where no agent is present. Inside a Claude Code session you are already the reviewer, and you now have the graph. See [Guardian in the README](https://github.com/zaebee/codegraph-brain#-guardian-graph-aware-code-review) to wire it into CI.

{codegraph_brain-0.6.0 → codegraph_brain-0.7.0}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.6.0"
+version = "0.7.0"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"

{codegraph_brain-0.6.0 → codegraph_brain-0.7.0}/tests/unit/test_guardian_bench.py

@@ -348,7 +348,7 @@ def test_killed_ids_are_reported_not_just_counted() -> None:
 
 
 def test_pr_278_entry_scores_every_prediction_as_noise() -> None:
-    """The precision baseline: an entry with no ground truth measures noise only (#279)."""
+    """The precision baseline: predictions that hit no GT are all noise (#279)."""
     truth = load_ground_truth(Path("benchmarks/guardian/pr-278.yaml"))
     predictions = [
         _pred("src/cgis/guardian/providers/base.py", 102),
@@ -359,12 +359,24 @@ def test_pr_278_entry_scores_every_prediction_as_noise() -> None:
 
     assert result.precision == 0.0
     assert result.noise == 2
-    assert result.recall == 1.0  # vacuous: no ground truth to miss
+    # The GT finding added in #258 is missed by these predictions, so recall is a
+    # real 0.0 rather than the vacuous 1.0 an empty ground truth would give.
+    assert result.recall == 0.0
+    assert result.missed == ["gemini-client-never-closed"]
 
 
 def test_pr_278_entry_files_nothing_as_ambiguous() -> None:
     """Ambiguous exempts per FILE, so one entry would blind the whole baseline."""
     truth = load_ground_truth(Path("benchmarks/guardian/pr-278.yaml"))
 
-    assert truth.findings == []
     assert truth.ambiguous == []
+
+
+def test_pr_278_gt_matches_a_finding_on_the_client_construction() -> None:
+    """The resource-leak class the finder lacks, anchored where the diff touched it (#258)."""
+    truth = load_ground_truth(Path("benchmarks/guardian/pr-278.yaml"))
+
+    hit = match_findings([_pred("src/cgis/guardian/providers/gemini.py", 41)], truth)
+
+    assert hit.matched == {"gemini-client-never-closed": 0}
+    assert hit.noise == []

codegraph_brain-0.6.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.6.0"
-}

codegraph_brain-0.6.0/benchmarks/guardian/pr-278.yaml

@@ -1,10 +0,0 @@
-# PR 278 — fix(guardian): explicit request timeout + bounded retry. See CURATION.md.
-# Guardian produced 10 findings, skeptic-confirmed 10/10, ALL refuted (#279).
-# head = review head (the snapshot guardian actually ran on); the two later
-# commits on that branch postdate the review.
-# GT findings: NONE → recall vacuously 1.0; this PR measures precision only.
-pr: 278
-base: 2e768cef585f10481970697657b0a9b40a411f47
-head: 6ee175e553c784a363c190e00021be5d365fb8dd
-findings: []
-ambiguous: []