codegraph-brain 0.7.0__tar.gz → 0.7.2__tar.gz

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/.github/workflows/autodoc.yml

@@ -26,7 +26,6 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
         with:
           enable-cache: true
-          python-version: "3.12"
 
       - name: Install CGIS
         run: uv sync

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/.github/workflows/ci.yml

@@ -18,7 +18,6 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
         with:
           enable-cache: true
-          python-version: "3.12"
 
       - name: Install Dependencies
         run: uv sync --group dev

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/.github/workflows/guardian.yml

@@ -67,7 +67,7 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
 
       - name: Install dependencies
-        run: uv sync --group guardian
+        run: uv sync --extra guardian
 
       - name: Build code graph
         run: uv run cgis ingest ./src --output graph.db

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/.github/workflows/release-please.yml

@@ -51,7 +51,6 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
         with:
           enable-cache: true
-          python-version: "3.12"
 
       - name: Build sdist and wheel
         run: uv build

codegraph_brain-0.7.2/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.2"
+}

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## [0.7.2](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.1...codegraph-brain-v0.7.2) (2026-07-31)
+
+
+### Bug Fixes
+
+* **ci:** install guardian deps with --extra, not --group ([#300](https://github.com/zaebee/codegraph-brain/issues/300)) ([1da003d](https://github.com/zaebee/codegraph-brain/commit/1da003d811db8e60201693905a6f83c2fccf48cf))
+* **cli:** escape data interpolated into Rich console output ([#298](https://github.com/zaebee/codegraph-brain/issues/298)) ([dd4943d](https://github.com/zaebee/codegraph-brain/commit/dd4943d0fea1100b47130fcb0790e940da83276a))
+* **drift:** pin measured depth when a domain is shallower than its gate ([#297](https://github.com/zaebee/codegraph-brain/issues/297)) ([1ebb93a](https://github.com/zaebee/codegraph-brain/commit/1ebb93a888037af5ad333ddffc7896af61f6eb5e)), closes [#229](https://github.com/zaebee/codegraph-brain/issues/229)
+
+
+### Documentation
+
+* add the chunked-review lab note (a negative result worth keeping) ([#299](https://github.com/zaebee/codegraph-brain/issues/299)) ([265fefd](https://github.com/zaebee/codegraph-brain/commit/265fefda7ee30ece692d13ea0bb171d99ac18bd9)), closes [#160](https://github.com/zaebee/codegraph-brain/issues/160)
+
+## [0.7.1](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.0...codegraph-brain-v0.7.1) (2026-07-31)
+
+
+### Documentation
+
+* add privacy policy ([#293](https://github.com/zaebee/codegraph-brain/issues/293)) ([33e45c2](https://github.com/zaebee/codegraph-brain/commit/33e45c2623d6d4a4c05106631fe2815ce1acf62e))
+* add the architecture audit offering ([#296](https://github.com/zaebee/codegraph-brain/issues/296)) ([086396d](https://github.com/zaebee/codegraph-brain/commit/086396dbfa569a5091439811d6ec00e1b094386f))
+
 ## [0.7.0](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.6.0...codegraph-brain-v0.7.0) (2026-07-31)
 
 

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraph-brain
-Version: 0.7.0
+Version: 0.7.2
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain
@@ -133,7 +133,7 @@ The fastest path — no config files, no paths to wire up:
 /plugin install cgis@codegraph-brain
 ```
 
-That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis-ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
+That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis:ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
 
 ---
 
@@ -235,6 +235,20 @@ classDef externalNode fill:#fff3e0,stroke:#e65100,stroke-width:1px,stroke-dashar
 
 ---
 
+## 💼 Architecture Audit
+
+CGIS is free and you can run it yourself. If you would rather have the analysis than the tool, I run a fixed-price audit of your codebase's structure — authorisation coverage, blast radius, coupling, architectural drift — delivered in five working days.
+
+**[Read what's included →](docs/AUDIT.md)** — $2,400 fixed, with an explicit list of what the analysis cannot see.
+
+---
+
+## 🔒 Privacy
+
+CGIS collects nothing: no telemetry, no analytics, no account. Your code and the graph built from it stay on your machine. See [PRIVACY.md](PRIVACY.md).
+
+---
+
 ## 🛠️ Development
 
 ### Requirements

codegraph_brain-0.7.2/PRIVACY.md

@@ -0,0 +1,45 @@
+# Privacy Policy
+
+**Last updated:** 31 July 2026
+
+This policy covers the **CGIS Claude Code plugin** and the **`codegraph-brain`** package it installs.
+
+## The short version
+
+CGIS collects nothing. There is no telemetry, no analytics, no usage reporting, no crash reporting, and no account. Your source code and the graph built from it stay on your machine. Nothing is sent to the author of this software, and there is no server to send it to.
+
+## What runs where
+
+**On your machine.** CGIS parses your source files with Tree-sitter and writes the resulting graph to a SQLite file (`graph.db` by default) in your project directory. Parsing, storage and every query happen locally. The graph contains structural information derived from your code — file paths, symbol names, line numbers and the call relationships between them — and it never leaves your disk.
+
+**Over the network, once.** On first use the plugin fetches the `codegraph-brain` package from the Python Package Index using `uvx`. This is an ordinary package download. PyPI is operated by the Python Software Foundation and applies its own logging and privacy practices to that request; see the [PSF Privacy Notice](https://www.python.org/privacy/). After the download is cached, the plugin makes no further network requests.
+
+## Data we collect
+
+None.
+
+We do not collect, transmit, store or have access to: your source code, the graphs built from it, file or repository names, prompts, tool calls, IP addresses, machine identifiers, usage counts, error reports, or anything else. This is not a matter of policy but of architecture — the software has no code that sends data anywhere, and no infrastructure to receive it.
+
+## Guardian, and when data does leave your machine
+
+The `codegraph-brain` package also contains **Guardian**, a code reviewer that sends diffs and graph context to a large language model. **Guardian is not part of the Claude Code plugin**: the plugin neither ships nor invokes it, and it does nothing unless you configure it and run it deliberately, normally in CI.
+
+If you choose to use Guardian, you select the model provider yourself — Google Gemini, Mistral, Cohere, or a local Ollama instance — and supply your own credentials. In that case the code being reviewed is sent to whichever provider you chose, under **that provider's** privacy policy and terms, not this one. Choosing Ollama keeps it local. We never see that traffic and never receive a copy.
+
+Credentials for those providers are read from your environment and used only to call the provider they belong to. They are not logged, stored or transmitted anywhere else.
+
+## What CGIS never touches
+
+CGIS reads source files under the path you point it at. It does not read your SSH keys, cloud credentials, browser data, keychain, clipboard, shell history, or files outside the directory you ingest. The plugin registers no Claude Code hooks, so it observes nothing about sessions, prompts or tool calls beyond its own tool invocations.
+
+## Children
+
+This is a developer tool and is not directed at children.
+
+## Changes
+
+Material changes to this policy will be recorded in this file, and its history is public in the repository's git log.
+
+## Contact
+
+Questions about privacy: open an issue at [github.com/zaebee/codegraph-brain/issues](https://github.com/zaebee/codegraph-brain/issues), or email zaebuntu@gmail.com.

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/README.md

@@ -83,7 +83,7 @@ The fastest path — no config files, no paths to wire up:
 /plugin install cgis@codegraph-brain
 ```
 
-That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis-ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
+That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis:ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
 
 ---
 
@@ -185,6 +185,20 @@ classDef externalNode fill:#fff3e0,stroke:#e65100,stroke-width:1px,stroke-dashar
 
 ---
 
+## 💼 Architecture Audit
+
+CGIS is free and you can run it yourself. If you would rather have the analysis than the tool, I run a fixed-price audit of your codebase's structure — authorisation coverage, blast radius, coupling, architectural drift — delivered in five working days.
+
+**[Read what's included →](docs/AUDIT.md)** — $2,400 fixed, with an explicit list of what the analysis cannot see.
+
+---
+
+## 🔒 Privacy
+
+CGIS collects nothing: no telemetry, no analytics, no account. Your code and the graph built from it stay on your machine. See [PRIVACY.md](PRIVACY.md).
+
+---
+
 ## 🛠️ Development
 
 ### Requirements

codegraph_brain-0.7.2/docs/AUDIT.md

@@ -0,0 +1,88 @@
+# 🔎 Architecture Audit
+
+**A measured read of your codebase's structure, delivered in five working days. $2,400 fixed.**
+
+CGIS is free and you can run it yourself. This is for teams who want the analysis rather than the tool: someone who has read a lot of these graphs telling you what yours says.
+
+---
+
+## What you get
+
+A written report, the graph itself, and ninety minutes on a call to walk through it.
+
+| Section | Measured with | The question it answers |
+| :--- | :--- | :--- |
+| **Authorisation coverage** | `cgis_audit_reachability` | Does every route handler actually reach its authz guard? |
+| **Blast radius** | `cgis_analyze_impact` | What breaks if we make the three changes we are planning? |
+| **Coupling and god-classes** | `cgis_metrics` | Which parts will fight back hardest during a refactor? |
+| **Architectural drift** | `cgis_drift` | How far has each domain moved from the pattern we said we follow? |
+| **Graph integrity** | `cgis_validate` | How much of this codebase is even amenable to static analysis? |
+
+The first row is the one that usually pays for the engagement. *"Is there a route in our API that reaches the database without passing a permission check?"* is a question with money attached, and nobody checks it by hand because on a few hundred endpoints it is a week of tedium. On the graph it is a traversal.
+
+The report names specific handlers, files and line numbers. It is not a maturity score out of ten.
+
+**You keep the graph.** The `graph.db` is handed over with the report, so your team can keep asking it questions after the engagement ends — including from Claude Code, via the plugin.
+
+---
+
+## How it runs
+
+1. **Access.** A read-only clone or a tarball. No production access, no credentials, no environment.
+2. **Ingest.** Your repositories go into a graph. If resolution comes out unusually low, you hear about it on day one, not in the report.
+3. **Analysis.** The five sections above, plus whatever the graph turns up that I did not expect. That last part is usually the interesting one.
+4. **Report.** Written, specific, with file and line references throughout.
+5. **Walkthrough.** Ninety minutes with whoever needs to act on it. Recorded if you want it.
+
+Five working days from receiving the code.
+
+---
+
+## Price
+
+**$2,400** for up to **three repositories** and **150,000 lines** of Python and TypeScript.
+
+Larger estates are quoted after a look at the tree — the honest number depends on how many resolution edge cases the code has, not on line count alone. There is no hourly rate and no change-order mechanism: the scope above is the scope.
+
+**Included:** the report, the graph, the walkthrough, and one round of follow-up questions by email within thirty days.
+
+**Not included:** implementing the fixes. If you want the drift gates wired into CI or Guardian reviewing your pull requests, that is separate work and we can talk about it after you have read the report — not before.
+
+---
+
+## What this is not
+
+The graph is static structure. That boundary is real, and it is better stated here than discovered halfway through.
+
+- **Not a penetration test.** Authorisation *coverage* means every handler has a static path to a guard. It does not mean the guard is correct, that the logic behind it is sound, or that the endpoint is unexploitable.
+- **Not a runtime analysis.** Nothing is executed. Behaviour that only appears under load, concurrency or real data is out of scope.
+- **Not a business-logic review.** The report says how your code is wired, not whether the wiring implements the right rules.
+- **Not language-complete.** Extractors cover Python and TypeScript. Vue, Astro, Go, Rust and everything else are invisible to the graph, and the report will say which parts of your codebase it could not see.
+- **Not a substitute for judgement.** An empty impact result means *no static callers found*, not *safe to delete*. Dynamic dispatch, registries and framework decorators do not appear in any static graph. The report flags where this matters instead of asserting a safety it cannot see.
+
+Roughly a tenth of call edges in a typical Python codebase cannot be resolved statically at all — they are calls on objects typed at runtime. That number is in the report too, because it tells you how much of the analysis to trust.
+
+---
+
+## Who this is for
+
+**A good fit if:** you have a Python or TypeScript codebase large enough that no one holds it in their head, you are planning a migration or a significant refactor, you are onboarding AI agents onto the codebase and getting confident nonsense back, or someone has asked whether your authorisation is actually complete and nobody can answer.
+
+**A poor fit if:** the codebase is small enough to read, the languages are outside the extractors, or what you actually need is a security assessment — in which case hire a security firm, and this is at best a first pass that tells them where to look.
+
+---
+
+## Evidence
+
+Before commissioning anything, read the [case study](CASE_STUDY.md). It is CGIS run against a real twelve-repository estate — 8,146 commits, four languages — with every figure measured and a section on what the analysis could not cover.
+
+If that page reads as honest to you, this engagement will run the same way. If it does not, we should not work together.
+
+---
+
+## Get in touch
+
+- **Email:** zaebuntu@gmail.com
+- **GitHub:** [open an issue](https://github.com/zaebee/codegraph-brain/issues) — fine for questions about scope, though most people prefer email for anything involving their own codebase
+
+Tell me roughly how large the codebase is and what you are trying to decide. If the audit is not the right thing for your situation, I will say so.

codegraph_brain-0.7.2/docs/lab-notes/2026-06-11-chunked-review-negative-result.md

@@ -0,0 +1,132 @@
+# Lab note: the chunked-review experiment — a negative result worth keeping
+
+**Date:** 2026-06-11
+**Experiment:** #154 slices 1–2 · **Code:** PR #157 (`6178bae`), PR #159 (`2030eb8`)
+**Verdict:** gate FAILED 3/4 — feature stays behind a flag, off in production
+**Specs:** [`2026-06-11-guardian-chunker-design.md`](../specs/2026-06-11-guardian-chunker-design.md) ·
+[`2026-06-11-guardian-chunked-review-design.md`](../specs/2026-06-11-guardian-chunked-review-design.md)
+
+The headline: the hypothesis survived contact with reality only partially, and the
+honest negative result is the most valuable artifact.
+
+## The problem
+
+Guardian (our in-repo LLM reviewer, replacing gemini-code-assist before its
+2026-07-17 sunset) reliably LGTMs large PRs. Baseline bench (6 replayed PRs with
+hand-curated ground truth, 3 runs each): mean recall 0.22, but **recall = 0 on all
+three largest PRs** (36–62K prompt tokens). Plan-2 ablations proved more context
+doesn't help: feeding 94K tokens of full files still produced LGTMs.
+
+Diagnosis: **attention dilution** — the finder skims, it doesn't read.
+
+## The hypothesis (#154)
+
+If the finder can't read a big diff, give it small ones: split changed files into
+connected components over the code graph (IMPORTS/CALLS from `cgis ingest`), run a
+finder pass per chunk with a per-chunk context budget, merge, dedup, run ONE
+skeptic pass, post one report. Each chunk = a small, complete world.
+
+## What we built
+
+- **Slice 1 (PR #157, `6178bae`)** — `chunker.py`, pure logic. Per-file diff
+  splitting (rename/deletion/binary/git-quoted-path handling), union-find over
+  graph edges, test-pairing heuristic, deterministic ordering, honest degradation
+  to isolated chunks when the graph DB is missing.
+- **Slice 2 (PR #159, `2030eb8`)** — wiring behind `GUARDIAN_FEATURES=chunked`.
+  `run_review_routed` entry point, per-chunk finder passes with per-chunk
+  `full_files` (120K char budget) + impact graph, out-of-chunk hallucination
+  filter with LLM-path-artifact normalization (`a/x.py` → `x.py`),
+  `(file,line,category)` dedup, single skeptic over finding-bearing chunks only,
+  `MAX_CHUNKS=8` cap with overflow merge, `cumulative_usage` token accounting
+  (which incidentally fixed a latent retry-loses-tokens bug).
+
+Both slices SDD-executed (subagent implementer + spec reviewer + quality
+reviewer), bench-gated by spec §7 **before** enabling anything in prod.
+
+## The gate (pre-registered, spec §7)
+
+1. mean recall (6 PRs) ≥ 0.27 — baseline + 0.05
+2. mean recall over large PRs {140, 143, 144} > 0 — the hypothesis must show where it matters
+3. mean noise ≤ 1.5/PR
+4. no PR drops > 0.05 below its baseline
+
+## The result: FAIL 3/4
+
+18 runs (6 PRs × 3, finder `gemini-2.5-flash`, skeptic `gemini-3.5-flash`), data in
+`benchmarks/guardian/results.jsonl`:
+
+| PR | chunks | recall base → chunked | noise base → chunked |
+|---|---|---|---|
+| 122 | 8 (cap) | 0.152 → 0.152 | 1.0 → **6.0** |
+| 140 | 5 | 0 → **0.067** ✨ | 3.3 → 3.3 |
+| 141 (noise probe) | 5 | 1.0 → 1.0 | 0.7 → 2.7 |
+| 142 | 1 (degenerate) | 0.167 → 0 | 0 → 0 |
+| 143 | 7 | 0 → 0 | 0 → 2.7 |
+| 144 | 5 | 0 → 0 | 0.7 → 1.3 |
+
+Mean recall 0.203 (❌ vs 0.27), large-PR recall 0.022 (✅ — but only PR 140
+contributed), noise 2.67/PR (❌ vs 1.5), PR 142 regression (❌, with a variance
+caveat: its baseline rested on one lucky 0.5 run out of three).
+
+## What we learned
+
+1. **Attention dilution is real but not the whole story.** Chunking produced the
+   first-ever nonzero recall on a large PR (140). But 143/144 stayed at zero across
+   21 small, focused finder calls. Those ground-truth bugs are invisible to this
+   finder *regardless of context size* — a model/prompt capability ceiling, not a
+   context problem.
+2. **Chunking multiplies noise superlinearly.** Every chunk invents its own false
+   positives (122: 8 chunks → noise 6.0/run). A single skeptic pass over
+   concatenated chunk contexts can't compensate.
+3. **Pre-registered gates work.** Writing pass/fail criteria into the spec before
+   spending money made the no-go decision mechanical instead of motivated. The flag
+   stays OFF in prod; the code sleeps behind it, fully tested, waiting for a better
+   noise story.
+4. **Honest degradation pays off.** Every failure mode (no graph DB, flaky chunk,
+   unparsable finder output, dead skeptic) degrades to something useful instead of
+   crashing — which also made the bench itself survivable.
+
+## Where this goes next (slice 3 candidates, not committed)
+
+- Noise mitigation: stricter per-chunk finder prompt, per-chunk findings cap,
+  skeptic hardening for chunked volume.
+- Ensemble finder (#155): union of N runs matched *different* GT findings
+  (122: 0.09/0.09/0.18 → union ~0.27) — possibly a cheaper recall lever than chunking.
+- Eyeball the 143/144 ground truths: if they need cross-file reasoning the finder
+  can't do, no amount of context plumbing will fix it.
+- Quotient-level "architectural chunk" (domain-graph drift as its own review unit).
+
+Total experiment cost: ~5 PLN of gemini billing for the slice-2 bench (1.03M prompt
+tokens), on top of Plan-2's bench budget. Money well burned.
+
+## Reproducing these numbers
+
+`benchmarks/guardian/results.jsonl` is committed, so the chunked side of this
+experiment is re-derivable. Group rows by `pr`, take the 3 rows whose `features`
+field contains `chunked` (all share `guardian_sha` `a866a2ac`), and average per PR:
+
+| Figure | Note | Recomputed |
+|---|---|---|
+| mean recall (6 PRs) | 0.203 | 0.203 |
+| mean noise / PR | 2.67 | 2.667 |
+| large-PR recall {140,143,144} | 0.022 | 0.022 |
+
+Every cell of the table's **chunked** column reproduces exactly.
+
+**The `base` column does not.** No single `guardian_sha` slice of the
+`features == ""` rows reproduces it, and the baseline headline of 0.22 mean recall
+does not fall out of any of them either — the two candidate slices with exactly 3
+runs per PR give 0.191 and 0.167, and the earliest slice gives 0.271 on uneven run
+counts. The file has also been appended to since (there are July 2026 rows from
+later work), so the working set used to compute the baseline in June is no longer
+recoverable from it.
+
+This is recorded rather than corrected: a lab journal is a historical record, and
+silently restating the baseline would be worse than flagging it. The gate
+conclusions do not rest on it — gates 1 and 3 failed on absolute values (0.203 <
+0.27, 2.67 > 1.5), and both reproduce. Gate 4 (per-PR regression vs baseline) is
+the one that cannot be independently re-checked today.
+
+## Refs
+
+#154, #155, #160 · PR #157, PR #159

codegraph_brain-0.7.2/docs/ontology/tolerances.lock

@@ -0,0 +1,27 @@
+# Drift-tolerance ratchet lock (#151) — generated from patterns.yaml, edited by hand.
+#
+# Project convention since #140/#141: drift_tolerance is a RATCHET. Values may
+# only go DOWN as domains get healthier, never up to mask a regression.
+#
+# test_tolerances_never_exceed_the_lock enforces it: lowering a tolerance means
+# updating this file in the same PR, which puts the change in the diff where a
+# reviewer sees it. Raising one fails the suite.
+#
+# Deliberate re-baselining (e.g. the Part B re-baseline in #144) is allowed —
+# update the lock and justify it in the PR description.
+
+project_domains:
+  extraction: 0.40
+  resolution: 0.40
+  pipeline: 0.25
+  storage: 0.20
+  query: 0.20
+  components: 0.20
+  layout: 0.50
+  hooks: 0.15
+  store: 0.15
+  providers: 0.15
+  utils: 0.15
+
+project_level:
+  cgis-project: 0.15

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/plugin/README.md

@@ -7,7 +7,7 @@ Gives Claude a deterministic semantic graph of your codebase instead of flat tex
 /plugin install cgis@codegraph-brain
 ```
 
-Then, in any repository, run `/cgis-ingest` once to build the graph.
+Then, in any repository, run `/cgis:ingest` once to build the graph.
 
 ## What it ships
 
@@ -15,7 +15,7 @@ Then, in any repository, run `/cgis-ingest` once to build the graph.
 | :--- | :--- |
 | MCP server `cgis` | 13 tools: impact analysis, flow tracing, structure, symbol search, metrics, architectural drift, authz reachability |
 | Skill `cgis` | Teaches the agent *when* to query the graph instead of reading files |
-| Command `/cgis-ingest` | Builds the graph on first use and reports what it found |
+| Skill `/cgis:ingest`  | Builds the graph on first use and reports what it found |
 
 ## What it does on your machine
 
@@ -42,3 +42,4 @@ Extractors exist for **Python** and **TypeScript** (`.py`, `.ts`, `.tsx`). Other
 - Source: [github.com/zaebee/codegraph-brain](https://github.com/zaebee/codegraph-brain)
 - Package: [pypi.org/project/codegraph-brain](https://pypi.org/project/codegraph-brain/)
 - Licence: MIT
+- Privacy: [PRIVACY.md](https://github.com/zaebee/codegraph-brain/blob/main/PRIVACY.md) — nothing is collected

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/plugin/skills/cgis/SKILL.md

@@ -31,7 +31,7 @@ The graph lives in `graph.db` in the project root, and every tool resolves that
 cgis_ingest(project_path="./src")
 ```
 
-Point it at the source root, not the repository root — ingesting `node_modules` or a virtualenv wastes time and pollutes the graph. `/cgis-ingest` does this for you and picks the right path.
+Point it at the source root, not the repository root — ingesting `node_modules` or a virtualenv wastes time and pollutes the graph. `/cgis:ingest` does this for you and picks the right path.
 
 Re-run `cgis_ingest` after any substantial change; it is incremental by default and skips unchanged files. A stale graph is worse than no graph, because it answers confidently and wrongly.
 

codegraph_brain-0.7.0/plugin/commands/cgis-ingest.md → codegraph_brain-0.7.2/plugin/skills/ingest/SKILL.md

@@ -1,6 +1,8 @@
 ---
+name: ingest
 description: Build or refresh the CGIS code graph for this repository
 argument-hint: "[source path — defaults to autodetected]"
+disable-model-invocation: true
 ---
 
 Build the CGIS semantic graph for this repository so the `cgis_*` tools can answer structural questions.

{codegraph_brain-0.7.0 → codegraph_brain-0.7.2}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.7.0"
+version = "0.7.2"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -81,6 +81,7 @@ dev = [
     "interrogate>=1.7.0",
     "ipdb>=0.13.13",
     "mypy>=2.1.0",
+    "networkx>=3.3",
     "pre-commit>=4.6.0",
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24.0",