codegraph-brain 0.7.3__tar.gz → 0.7.4__tar.gz

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/.github/workflows/autodoc.yml

@@ -28,15 +28,15 @@ jobs:
           enable-cache: true
 
       - name: Install CGIS
-        run: uv sync
+        run: uv sync --frozen
 
       - name: Self-ingest core engine
-        run: uv run cgis ingest ./src --output /tmp/self_graph.db
+        run: uv run --frozen cgis ingest ./src --output /tmp/self_graph.db
 
       - name: Generate pipeline flow diagram
         run: |
           mkdir -p docs/architecture/diagrams
-          uv run cgis trace "cgis.pipeline.IngestionPipeline.run" \
+          uv run --frozen cgis trace "cgis.pipeline.IngestionPipeline.run" \
             --db /tmp/self_graph.db \
             --depth 1 \
             --format mermaid \
@@ -44,21 +44,21 @@ jobs:
             > docs/architecture/diagrams/pipeline_flow.mermaid
 
       - name: Compute graph health badge
-        run: uv run python scripts/generate_health.py --db /tmp/self_graph.db
+        run: uv run --frozen python scripts/generate_health.py --db /tmp/self_graph.db
 
       - name: Inject graph into README.md
         run: |
-          uv run python scripts/inject_readme_graph.py \
+          uv run --frozen python scripts/inject_readme_graph.py \
             --db /tmp/self_graph.db \
             --fqn "cgis.pipeline.IngestionPipeline.run" \
             --depth 1 \
             --path-prefix "src/"
 
       - name: Generate MCP reference manual
-        run: uv run python scripts/generate_mcp_ref.py
+        run: uv run --frozen python scripts/generate_mcp_ref.py
 
       - name: Sync schema docs from source
-        run: uv run python scripts/generate_schema_docs.py
+        run: uv run --frozen python scripts/generate_schema_docs.py
 
       - name: Open PR with generated docs
         uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676  # v7

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/.github/workflows/ci.yml

@@ -20,24 +20,27 @@ jobs:
           enable-cache: true
 
       - name: Lockfile in step with pyproject
-        # MUST run before `uv sync`: sync silently re-resolves and rewrites
-        # uv.lock, so a check placed after it would always pass.
+        # This is the only step that validates the lockfile. `--frozen` below stops
+        # uv rewriting uv.lock, but it does not check that the lock is current —
+        # that is `--locked`. Keeping the check explicit gives a clearer failure
+        # than a sync error, and it still runs first so an unfrozen uv could never
+        # repair the lock ahead of it.
         run: uv lock --check
 
       - name: Install Dependencies
-        run: uv sync --group dev
+        run: uv sync --frozen --group dev
 
       - name: Ruff Format Check
-        run: uv run ruff format --check .
+        run: uv run --frozen ruff format --check .
 
       - name: Ruff Lint
-        run: uv run ruff check .
+        run: uv run --frozen ruff check .
 
       - name: Interrogate (≥90% docstring coverage)
-        run: uv run interrogate -v --fail-under 90 src/cgis
+        run: uv run --frozen interrogate -v --fail-under 90 src/cgis
 
       - name: Mypy (strict)
-        run: uv run mypy src
+        run: uv run --frozen mypy src
 
       - name: Pytest
-        run: uv run pytest --cov=cgis --cov-report=term-missing
+        run: uv run --frozen pytest --cov=cgis --cov-report=term-missing

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/.github/workflows/guardian.yml

@@ -67,10 +67,10 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
 
       - name: Install dependencies
-        run: uv sync --extra guardian
+        run: uv sync --frozen --extra guardian
 
       - name: Build code graph
-        run: uv run cgis ingest ./src --output graph.db
+        run: uv run --frozen cgis ingest ./src --output graph.db
 
       - name: Restore metrics from data branch
         run: |
@@ -91,7 +91,7 @@ jobs:
           GUARDIAN_SKEPTIC: ${{ vars.GUARDIAN_SKEPTIC }}
           GUARDIAN_SKEPTIC_MODEL: ${{ vars.GUARDIAN_SKEPTIC_MODEL }}
         run: |
-          uv run python scripts/guardian_review.py \
+          uv run --frozen python scripts/guardian_review.py \
             --output guardian_report.md \
             --db graph.db \
             --pr "$PR_NUMBER" \
@@ -219,7 +219,7 @@ jobs:
           git show origin/data/guardian-metrics:guardian_metrics.jsonl \
             > guardian_metrics.jsonl
 
-          uv run cgis guardian-rate "$PR_NUMBER" "$APPLIED" \
+          uv run --frozen cgis guardian-rate "$PR_NUMBER" "$APPLIED" \
             --metrics guardian_metrics.jsonl
 
           if git ls-remote --exit-code origin data/guardian-metrics > /dev/null 2>&1; then

codegraph_brain-0.7.4/.github/workflows/pr-title.yml

@@ -0,0 +1,51 @@
+name: PR Title
+
+# The repository squash-merges, so the PR title becomes the commit subject that
+# release-please parses. A title it does not recognise is dropped from the
+# changelog silently — no warning, no failure. That has now happened twice:
+# #297 ("drift trust batch: …", a descriptive title) and #313
+# ("security(mcp): …", a type that does not exist), the second of which would
+# have shipped a security fix invisibly.
+on:
+  pull_request:
+    branches: [ main ]
+    # `edited` matters: without it, fixing a rejected title would not re-run
+    # the check. Kept in a separate workflow from ci.yml so retitling does not
+    # replay the whole test suite.
+    types: [ opened, edited, reopened, synchronize ]
+
+permissions: {}
+
+jobs:
+  conventional-title:
+    name: Conventional commit title
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the title release-please will parse
+        env:
+          # Never interpolate an untrusted title straight into `run:` — it is
+          # attacker-controlled text. Through the environment it is just data.
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          set -euo pipefail
+          # Types release-please understands. Anything else is dropped from the
+          # changelog without complaint, which is the failure being prevented.
+          TYPES='feat|fix|docs|chore|style|refactor|perf|test|build|ci|revert'
+          if printf '%s' "$PR_TITLE" | grep -qE "^($TYPES)(\([a-z0-9._/-]+\))?!?: .+"; then
+            printf '::notice::PR title is a conventional commit.\n'
+            exit 0
+          fi
+          printf '::error::PR title is not a conventional commit: %s\n' "$PR_TITLE"
+          cat >&2 <<'MSG'
+
+          This repository squash-merges, so the PR title becomes the commit
+          subject release-please reads. An unrecognised type is dropped from the
+          CHANGELOG silently.
+
+          Expected:  <type>(<optional scope>): <description>
+          Types:     feat fix docs chore style refactor perf test build ci revert
+
+          Note there is no `security` type — use `fix` with a scope:
+              fix(mcp): validate db_path before cgis_ingest creates a database
+          MSG
+          exit 1

codegraph_brain-0.7.4/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.4"
+}

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.7.4](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.3...codegraph-brain-v0.7.4) (2026-08-01)
+
+
+### Bug Fixes
+
+* **mcp:** validate db_path before cgis_ingest creates a database ([#313](https://github.com/zaebee/codegraph-brain/issues/313)) ([2c5499b](https://github.com/zaebee/codegraph-brain/commit/2c5499b8fb7f0d40a03144417c3210900371d499)), closes [#312](https://github.com/zaebee/codegraph-brain/issues/312)
+
+
+### Documentation
+
+* auto-sync architecture graph and MCP reference ([#314](https://github.com/zaebee/codegraph-brain/issues/314)) ([7d5b666](https://github.com/zaebee/codegraph-brain/commit/7d5b66669f9dfa40e2fc86dd59a4baf492a9342e))
+
 ## [0.7.3](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.2...codegraph-brain-v0.7.3) (2026-07-31)
 
 

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraph-brain
-Version: 0.7.3
+Version: 0.7.4
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/docs/how-to/MCP_REFERENCE.md

@@ -176,9 +176,14 @@ Show the structural layout (CONTAINS/DECLARES) of a module or class.
 Scan a local directory, extract all symbols, resolve links, and build the graph DB.
 
     Use this to initialise or refresh the code knowledge graph for a project.
-    Paths are normalised relative to the workspace root so the database is
+    Node FQNs are normalised relative to the workspace root so the graph is
     portable across machines.
 
+    ``db_path`` must name a database — it has to end in ``.db``, ``.sqlite`` or
+    ``.sqlite3``, live in a directory that already exists, and not point at an
+    existing file that is not a SQLite database. cgis will not create parent
+    directories.
+
     By default the ingest is **incremental**: only changed/new files are
     re-scanned, and the summary reports both what changed this run and the
     whole-graph total. Set ``full_rebuild=True`` to re-scan every file and

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.7.3"
+version = "0.7.4"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/src/cgis/api/mcp_server.py

@@ -85,20 +85,92 @@ def _render_subgraph(
     return f"❌ Unknown format '{output_format}'. Use 'mermaid' or 'json'."
 
 
+#: Names cgis will create a database under. Everything else is refused, so an
+#: agent cannot be talked into materialising `~/.ssh/authorized_keys` (#312).
+_DB_SUFFIXES = frozenset({".db", ".sqlite", ".sqlite3"})
+
+#: First 16 bytes of any SQLite file.
+_SQLITE_MAGIC = b"SQLite format 3\x00"
+
+
+def _reject_db_path(db_path: str) -> str | None:
+    """Return a refusal message for an unusable ``db_path``, or None if it is fine.
+
+    ``cgis_ingest`` is the only MCP tool that creates its database — the other
+    twelve refuse a path that does not already exist, which is guard enough for
+    them. It needs a different one: it reads untrusted repository content and is
+    then told by the same agent where to write, so ``db_path`` is attacker-
+    reachable in a way the read-only tools' paths are not.
+
+    Refuses an unexpected suffix, a missing parent directory (creating a tree is
+    never wanted), a directory target, and an existing file that is not a
+    database. The last is belt-and-braces — SQLite already declines to open a
+    non-database — but it fails with a message that says why.
+
+    Everything is judged on the **resolved** path. A dangling symlink is the
+    bypass this guard exists to stop: ``attack.db`` pointing at a target that
+    does not exist yet makes ``is_file()`` return False, every check passes, and
+    SQLite creates the target. Resolving first means the suffix rule applies to
+    where the write actually lands. (A symlink to an *existing* non-database was
+    already refused by the magic-byte check.)
+
+    The filesystem probes are wrapped: this runs *before* ``cgis_ingest``'s own
+    try/except, and ``Path.resolve()``, ``Path.is_dir()`` and friends propagate
+    ``OSError`` (a ``PermissionError`` on the parent, or a symlink loop), which
+    would escape the tool as a crash instead of a message the agent can act on.
+    """
+    try:
+        path = Path(db_path).resolve()
+    except OSError as exc:
+        return f"❌ Refusing db_path '{db_path}': path is inaccessible ({exc})."
+    # Case-insensitive: `.DB` carries the same intent, and on a case-insensitive
+    # filesystem it is literally the same file.
+    if path.suffix.lower() not in _DB_SUFFIXES:
+        allowed = ", ".join(sorted(_DB_SUFFIXES))
+        return f"❌ Refusing db_path '{db_path}': name must end in one of {allowed}."
+    try:
+        if path.is_dir():
+            return f"❌ Refusing db_path '{db_path}': it is a directory."
+        if not path.parent.is_dir():
+            return (
+                f"❌ Refusing db_path '{db_path}': parent directory does not exist. "
+                "cgis will not create one."
+            )
+        if path.is_file() and path.stat().st_size > 0:
+            with path.open("rb") as fh:
+                if fh.read(len(_SQLITE_MAGIC)) != _SQLITE_MAGIC:
+                    return (
+                        f"❌ Refusing db_path '{db_path}': existing file is not a SQLite database."
+                    )
+    except OSError as exc:
+        return f"❌ Refusing db_path '{db_path}': path is inaccessible ({exc})."
+    return None
+
+
 @mcp.tool()
 def cgis_ingest(project_path: str, db_path: str = _DEFAULT_DB, full_rebuild: bool = False) -> str:
     """Scan a local directory, extract all symbols, resolve links, and build the graph DB.
 
     Use this to initialise or refresh the code knowledge graph for a project.
-    Paths are normalised relative to the workspace root so the database is
+    Node FQNs are normalised relative to the workspace root so the graph is
     portable across machines.
 
+    ``db_path`` must name a database — it has to end in ``.db``, ``.sqlite`` or
+    ``.sqlite3``, live in a directory that already exists, and not point at an
+    existing file that is not a SQLite database. cgis will not create parent
+    directories.
+
     By default the ingest is **incremental**: only changed/new files are
     re-scanned, and the summary reports both what changed this run and the
     whole-graph total. Set ``full_rebuild=True`` to re-scan every file and
     overwrite the database from scratch — use this to drop nodes for files that
     were deleted or renamed, which an incremental run leaves behind.
     """
+    refusal = _reject_db_path(db_path)
+    if refusal is not None:
+        logger.warning("MCP ingest refused db_path", db=db_path)
+        return refusal
+
     pipeline = IngestionPipeline(_EXTRACTORS)
     try:
         with SQLiteStore(db_path) as store:

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/src/cgis/resolver/engine.py

@@ -126,7 +126,7 @@ class ResolverEngine:
 
     def _ensure_virtual_node(self, target: str, virtual_nodes: dict[str, Node]) -> None:
         """Create a virtual boundary node for target if it is not already in the graph."""
-        if target not in self._index.nodes and target not in virtual_nodes:
+        if not self._index.has_node(target) and target not in virtual_nodes:
             virtual_nodes[target] = self._make_virtual_node(
                 target, self._index.classify_fqn(target)
             )

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/src/cgis/resolver/indices.py

@@ -3,7 +3,9 @@
 import builtins
 import os
 import sys
+from collections.abc import Mapping
 from dataclasses import dataclass
+from types import MappingProxyType
 
 from cgis.core.models import SELF_PREFIX, Node, NodeNamespace, NodeType
 
@@ -15,30 +17,37 @@ class SymbolIndex:
     """Immutable lookup indices over the extracted node set.
 
     Built by IndexBuilder, consumed by SymbolResolver and ResolverEngine.
-    Frozen by convention (field rebinding prevented); the contained dicts
-    are never mutated after construction.
+
+    Immutable in substance, not only by convention: the dataclass prevents
+    field rebinding, and ``IndexBuilder`` hands over read-only views, so a
+    stray write (a cache line added to a shared index, say) raises instead of
+    silently corrupting resolution for every later lookup (#183).
+
+    The views are shallow — the inner ``list``/``dict`` values are still
+    mutable. Deep-freezing would mean copying every one of them on a hot path;
+    the realistic mistake this guards is adding or replacing a top-level key.
     """
 
     # node id (FQN) -> Node
-    nodes: dict[str, Node]
+    nodes: Mapping[str, Node]
     # name -> list of FQNs
-    global_symbols: dict[str, list[str]]
+    global_symbols: Mapping[str, list[str]]
     # (file_path, name) -> list of FQNs (list handles conditional redefinitions)
-    file_global_symbols: dict[tuple[str, str], list[str]]
+    file_global_symbols: Mapping[tuple[str, str], list[str]]
     # class_fqn -> {method_name -> method_fqn}
-    class_methods: dict[str, dict[str, str]]
+    class_methods: Mapping[str, dict[str, str]]
     # DI-alias (VARIABLE) indices for raw_dep: resolution; kept separate
     # from global_symbols so call resolution behavior does not change.
-    variable_symbols: dict[str, list[str]]
-    file_variable_symbols: dict[tuple[str, str], list[str]]
+    variable_symbols: Mapping[str, list[str]]
+    file_variable_symbols: Mapping[tuple[str, str], list[str]]
     # normalized file_path -> {local_alias: target_fqn}  (from FILE node import_map)
-    file_imports: dict[str, dict[str, str]]
+    file_imports: Mapping[str, dict[str, str]]
     # suffix_fqn -> [full_node_ids]  (handles src/ layout prefix mismatch)
-    suffix_map: dict[str, list[str]]
+    suffix_map: Mapping[str, list[str]]
     # top-level root segments of all internal nodes (for classify)
-    internal_roots: set[str]
+    internal_roots: frozenset[str]
     # root segments of absolute imports (anything else is UNKNOWN)
-    external_roots: set[str]
+    external_roots: frozenset[str]
 
     def map_to_node_fqn(self, imported_fqn: str) -> str | None:
         """Resolve an imported FQN to an actual node in the graph.
@@ -65,6 +74,14 @@ class SymbolIndex:
                 return candidate
         return None
 
+    def has_node(self, fqn: str) -> bool:
+        """True if the graph holds a node with this exact FQN.
+
+        Saves callers reaching into ``nodes`` for a membership test, which is
+        the one place the index's internals leaked (#183).
+        """
+        return fqn in self.nodes
+
     def classify_fqn(self, fqn: str) -> NodeNamespace:
         """Classify an FQN as STDLIB, INTERNAL, EXTERNAL, or UNKNOWN.
 
@@ -145,17 +162,19 @@ class IndexBuilder:
             # "src.cgis.pipeline.X" → suffix "cgis.pipeline.X" also points to the node
             self._add_node_to_suffix_map(node.id, suffix_map, internal_roots)
 
+        # Read-only views, not copies: MappingProxyType wraps in O(1), so this
+        # buys write protection without touching ingest cost (#183).
         return SymbolIndex(
-            nodes=nodes_by_id,
-            global_symbols=global_symbols,
-            file_global_symbols=file_global_symbols,
-            class_methods=class_methods,
-            variable_symbols=variable_symbols,
-            file_variable_symbols=file_variable_symbols,
-            file_imports=file_imports,
-            suffix_map=suffix_map,
-            internal_roots=internal_roots,
-            external_roots=self._build_external_roots(file_imports),
+            nodes=MappingProxyType(nodes_by_id),
+            global_symbols=MappingProxyType(global_symbols),
+            file_global_symbols=MappingProxyType(file_global_symbols),
+            class_methods=MappingProxyType(class_methods),
+            variable_symbols=MappingProxyType(variable_symbols),
+            file_variable_symbols=MappingProxyType(file_variable_symbols),
+            file_imports=MappingProxyType(file_imports),
+            suffix_map=MappingProxyType(suffix_map),
+            internal_roots=frozenset(internal_roots),
+            external_roots=frozenset(self._build_external_roots(file_imports)),
         )
 
     def _add_node_to_suffix_map(

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/tests/unit/test_cohesion.py

@@ -120,7 +120,9 @@ def test_modularity_isolated_files_are_singletons() -> None:
 def test_modularity_is_deterministic() -> None:
     adj = {**_clique("p", ["a", "b", "c"]), **_clique("p", ["x", "y", "z"])}
     g = FileGraph(files=tuple(sorted(adj)), adj=adj)
-    assert greedy_modularity(g) == greedy_modularity(g)
+    first = greedy_modularity(g)
+    second = greedy_modularity(g)
+    assert first == second, "greedy_modularity must not depend on dict iteration order"
 
 
 def test_divergence_flat_layout_vs_multi_community_is_one() -> None:

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/tests/unit/test_guardian_chunker.py

@@ -313,7 +313,9 @@ def test_build_chunks_deterministic(tmp_path: Path) -> None:
         [_edge("src.cgis.a", "src.cgis.b")],
     )
     diff = fdiff("src/cgis/c.py") + fdiff("src/cgis/a.py") + fdiff("src/cgis/b.py")
-    assert build_chunks(diff, store) == build_chunks(diff, store)
+    first = build_chunks(diff, store)
+    second = build_chunks(diff, store)
+    assert first == second, "chunk membership and ordering must be stable across runs"
 
 
 def test_split_duplicate_path_blocks_merged() -> None:

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/tests/unit/test_mcp_server.py

@@ -1,6 +1,7 @@
 """Unit tests for the MCP server tools."""
 
 import json
+import os
 import re
 from pathlib import Path
 
@@ -806,3 +807,153 @@ def test_cgis_suggest_packages_missing_db(tmp_path: Path) -> None:
     """A missing db returns an error string, not a crash (#242)."""
     result = cgis_suggest_packages(str(tmp_path / "no.db"), prefix="mod")
     assert "not found" in result.lower()
+
+
+# ---------------------------------------------------------------------------
+# db_path guard for cgis_ingest (#312)
+# ---------------------------------------------------------------------------
+#
+# cgis_ingest is the only MCP tool that creates its database — the other twelve
+# refuse a db_path that does not already exist. It therefore needs a different
+# guard, not the same one: it reads untrusted repository content and is then
+# told by the same agent where to write, so a hostile db_path is a real shape.
+
+
+def test_ingest_refuses_to_clobber_a_non_sqlite_file(tmp_path: Path) -> None:
+    """An existing file that is not a database must survive untouched."""
+    victim = tmp_path / "config.db"
+    original = "PermitRootLogin no\n"
+    victim.write_text(original, encoding="utf-8")
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+
+    result = cgis_ingest(str(tmp_path), str(victim))
+
+    assert "❌" in result
+    assert victim.read_text(encoding="utf-8") == original, "the target file was modified"
+
+
+def test_ingest_refuses_to_create_parent_directories(tmp_path: Path) -> None:
+    """A missing parent must be an error, not an invitation to build a tree."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    nested = tmp_path / "does" / "not" / "exist" / "graph.db"
+
+    result = cgis_ingest(str(tmp_path), str(nested))
+
+    assert "❌" in result
+    assert not nested.parent.exists(), "parent directories were created"
+
+
+def test_ingest_refuses_an_unexpected_suffix(tmp_path: Path) -> None:
+    """Only database-shaped names are accepted, so `~/.ssh/config` cannot be a target."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    target = tmp_path / "authorized_keys"
+
+    result = cgis_ingest(str(tmp_path), str(target))
+
+    assert "❌" in result
+    assert not target.exists()
+
+
+def test_ingest_refuses_a_directory_as_db_path(tmp_path: Path) -> None:
+    """A directory target must be rejected rather than surfacing a sqlite error."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    target = tmp_path / "graph.db"
+    target.mkdir()
+
+    result = cgis_ingest(str(tmp_path), str(target))
+
+    assert "❌" in result
+    assert target.is_dir()
+
+
+def test_ingest_accepts_an_existing_empty_file(tmp_path: Path) -> None:
+    """An empty placeholder is what SQLite itself would create — not a clobber."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    placeholder = tmp_path / "graph.db"
+    placeholder.touch()
+
+    result = cgis_ingest(str(tmp_path), str(placeholder))
+
+    assert "✅" in result
+    # Not just "it did not refuse": the placeholder must now be a real database,
+    # otherwise the guard could pass while ingestion quietly wrote nothing.
+    assert placeholder.stat().st_size > 0
+    with placeholder.open("rb") as fh:
+        assert fh.read(16) == b"SQLite format 3\x00"
+
+
+def test_ingest_still_accepts_an_existing_database(tmp_path: Path) -> None:
+    """The guard must not break re-ingesting into a real database."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    db = tmp_path / "graph.db"
+    assert "✅" in cgis_ingest(str(tmp_path), str(db))
+
+    result = cgis_ingest(str(tmp_path), str(db), full_rebuild=True)
+
+    assert "✅" in result
+
+
+@pytest.mark.skipif(os.geteuid() == 0, reason="root bypasses directory permissions")
+def test_ingest_reports_an_unreadable_path_instead_of_raising(tmp_path: Path) -> None:
+    """The guard runs before cgis_ingest's own try/except, so it must not raise.
+
+    `Path.is_dir()` and friends propagate OSError (a PermissionError on the
+    parent, for one). Without handling, that escapes the MCP tool as a crash
+    rather than a message the agent can act on.
+    """
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    locked = tmp_path / "locked"
+    locked.mkdir()
+    (locked / "graph.db").write_text("junk", encoding="utf-8")
+    locked.chmod(0o000)
+    try:
+        result = cgis_ingest(str(tmp_path), str(locked / "graph.db"))
+    finally:
+        locked.chmod(0o755)
+
+    assert "❌" in result
+
+
+def test_ingest_refuses_a_dangling_symlink(tmp_path: Path) -> None:
+    """A `.db` symlink whose target does not exist must not become a write primitive.
+
+    This is the bypass, and it hinges on the target being absent: `is_file()`
+    returns False for a dangling symlink, so every check passed and SQLite
+    happily created the target. A symlink pointing at an *existing* non-database
+    was already refused by the magic-byte check, so testing that variant would
+    have proved nothing.
+    """
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    target = tmp_path / "elsewhere" / "authorized_keys"
+    target.parent.mkdir()
+    link = tmp_path / "attack.db"
+    link.symlink_to(target)
+
+    result = cgis_ingest(str(tmp_path), str(link))
+
+    assert "❌" in result
+    assert not target.exists(), "the symlink target was created"
+
+
+def test_ingest_refuses_a_symlink_to_a_non_database(tmp_path: Path) -> None:
+    """The already-covered variant, kept as a regression guard."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    victim = tmp_path / "secrets.txt"
+    victim.write_text("sensitive\n", encoding="utf-8")
+    link = tmp_path / "attack.db"
+    link.symlink_to(victim)
+
+    result = cgis_ingest(str(tmp_path), str(link))
+
+    assert "❌" in result
+    assert victim.read_text(encoding="utf-8") == "sensitive\n"
+
+
+def test_ingest_accepts_an_uppercase_suffix(tmp_path: Path) -> None:
+    """Suffix matching is case-insensitive — `.DB` is the same intent as `.db`."""
+    (tmp_path / "mod.py").write_text("def fn(): pass\n", encoding="utf-8")
+    db = tmp_path / "graph.DB"
+
+    result = cgis_ingest(str(tmp_path), str(db))
+
+    assert "✅" in result

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/tests/unit/test_mermaid.py

@@ -159,9 +159,11 @@ def test_compile_output_is_deterministic() -> None:
     nodes = [_make_node("src/cgis/cli.py:some_function")]
     edges = [_make_edge("src/cgis/cli.py:some_function", "src/cgis/other.py:helper")]
     compiler = MermaidCompiler()
-    assert compiler.compile(nodes, edges) == compiler.compile(nodes, edges)
-    # Hashed IDs must be alphanumeric — no raw slashes or colons in node declarations
     output = compiler.compile(nodes, edges)
+    second = compiler.compile(nodes, edges)
+    assert output == second, "compile output must be stable — IDs are hashed, not counted"
+
+    # Hashed IDs must be alphanumeric — no raw slashes or colons in node declarations
     for line in output.splitlines():
         if "-->|" in line:
             parts = line.strip().split(" -->|")

{codegraph_brain-0.7.3 → codegraph_brain-0.7.4}/tests/unit/test_ontology_init.py

@@ -184,7 +184,9 @@ def test_propose_no_fit_goes_hygiene_only(tmp_path: Path) -> None:
 
 def test_propose_deterministic(two_domain_db: str) -> None:
     """Two runs over the same graph are byte-identical."""
-    assert propose_ontology(two_domain_db) == propose_ontology(two_domain_db)
+    first = propose_ontology(two_domain_db)
+    second = propose_ontology(two_domain_db)
+    assert first == second, "propose_ontology must be byte-identical across runs"
 
 
 def test_header_templates_match_repo_ontology() -> None: