codegraphcontext 0.6.0__tar.gz → 0.6.2__tar.gz

{codegraphcontext-0.6.0/src/codegraphcontext.egg-info → codegraphcontext-0.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraphcontext
-Version: 0.6.0
+Version: 0.6.2
 Summary: An MCP server that indexes local code into a graph database to provide context to AI assistants.
 Author-email: Shashank Shekhar Singh <shashankshekharsingh1205@gmail.com>
 License: MIT License

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codegraphcontext"
-version = "0.6.0"
+version = "0.6.2"
 description = "An MCP server that indexes local code into a graph database to provide context to AI assistants."
 authors = [{ name = "Shashank Shekhar Singh", email = "shashankshekharsingh1205@gmail.com" }]
 readme = "README.md"

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/cli/config_manager.py

@@ -274,6 +274,7 @@ dist/
 build/
 target/
 out/
+obj/
 .git/
 .idea/
 .vscode/

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/core/database_embedded_kuzu.py

@@ -798,21 +798,32 @@ class EmbeddedSessionWrapper:
         translated_query, translated_params = self._translate_query(query, parameters)
         debug_log(f"Translated Query: {translated_query[:200]}")
         try:
-            # Force loop fallback for relationship writes inside UNWIND to avoid Kuzu query planner bugs
-            # which can incorrectly bind/corrupt relationship endpoints across rows in the batch.
-            # Only force it for `UNWIND $param AS row`, the single shape the
-            # recovery path below can rewrite into a per-row loop. Read queries
-            # that unwind a bound list (`WITH relationships(p) AS rels UNWIND
-            # rels AS r`, used by find_all_callers/find_all_callees and the
-            # visualizer) matched this guard too, but no `$`-UNWIND for the
-            # fallback to latch onto — so the fabricated exception fell through
-            # every handler and surfaced to the caller as a hard failure.
+            # Force the per-row loop fallback ONLY for UNWIND batches containing a
+            # node-MERGE. Kùzu's MERGE pipeline mis-binds when a merged node's key
+            # value repeats NON-adjacently across the batch: in
+            # [(A,P), (B,X), (C,P)] the C row binds to X's node instead of
+            # re-matching P (reproduced on Kùzu 0.11.3; see #1605). Relationship-only
+            # MERGEs (MATCH … MATCH … MERGE (a)-[r]->(b)) do not exhibit the bug —
+            # verified with interleaved duplicate endpoint keys and duplicate pairs —
+            # so they now run batched, which removes the bulk of the per-row planner
+            # overhead (~2.4x on a full index of the Python sample project).
+            # Only `UNWIND $param AS row` shapes are guarded — that is the single
+            # shape the recovery path below can rewrite into a per-row loop. Read
+            # queries that unwind a bound list (`WITH relationships(p) AS rels
+            # UNWIND rels AS r`) must not match, or the fabricated exception would
+            # surface to the caller as a hard failure.
+            # Node-only UNWIND writes (`MERGE (n:Label {…}) SET n += row`, no
+            # relationship pattern) have always batched through the SET-expansion
+            # path and the per-row rewriter cannot handle their bare `SET n += row`,
+            # so the guard additionally requires a relationship pattern.
+            _has_node_merge = re.search(r"MERGE\s*\(\s*\w+\s*:", query)
             if (
                 re.search(r"UNWIND\s+\$\w+\s+AS\s+\w+", query)
                 and ("-[" in query or "]->" in query)
+                and _has_node_merge
                 and not getattr(self, "_skip_unwind_fallback", False)
             ):
-                raise Exception("unordered_map::at (forced fallback to avoid relationship UNWIND planner bugs)")
+                raise Exception("unordered_map::at (forced fallback: node-MERGE inside UNWIND mis-binds repeated keys)")
 
             # 2. Execute under the lock. _write_lock (name kept for backward
             # compat) now serializes ALL access, reads included: kuzu.Connection
@@ -1200,8 +1211,11 @@ class EmbeddedSessionWrapper:
             return f"{prefix}NOT label({var_name}) = '{label_name}'"
         query = re.sub(r'(WHERE\s+|AND\s+|OR\s+)NOT\s+(\w+):([a-zA-Z0-9_`]+)', not_label_replacer, query, flags=re.IGNORECASE)
 
-        # 4. Polymorphic matches and label access
-        query = query.replace("labels(n)[0]", "label(n)")
+        # 4. Polymorphic matches and label access. Kùzu has no labels();
+        # rewrite labels(<var>)[0] for ANY variable name — the literal
+        # "labels(n)[0]" form missed n1/n2 and the simulator's relationship
+        # query reached the engine unsupported (#1512).
+        query = re.sub(r'labels\((\w+)\)\s*\[\s*0\s*\]', r'label(\1)', query)
 
         query = query.replace("coalesce(", "COALESCE(")
         query = re.sub(r'\btype\(', 'label(', query)

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/core/jobs.py

@@ -40,6 +40,7 @@ class JobInfo:
     result: Optional[Dict[str, Any]] = None
     path: Optional[str] = None
     is_dependency: bool = False
+    last_update_time: Optional[datetime] = None
 
     def __post_init__(self):
         """Ensures the errors list is initialized after the object is created."""
@@ -93,6 +94,7 @@ class JobManager:
                 for key, value in kwargs.items():
                     if hasattr(job, key):
                         setattr(job, key, value)
+                job.last_update_time = datetime.now()
 
     def get_job(self, job_id: str) -> Optional[JobInfo]:
         """Retrieves the information for a single job."""
@@ -132,15 +134,36 @@ class JobManager:
     def cleanup_old_jobs(self, max_age_hours: int = 24):
         """Removes old jobs from memory to prevent memory leaks.
 
-        Finished jobs are aged by end_time; jobs that never finished (e.g.
-        crashed while PENDING/RUNNING) are aged by start_time so they don't
-        leak forever.
+        Terminal jobs (COMPLETED/FAILED/CANCELLED) are aged by end_time,
+        falling back to start_time.
+
+        Jobs still PENDING/RUNNING are never deleted outright (#1537): a
+        healthy long-running index updates its progress constantly, and
+        deleting its record makes update_job silently no-op and
+        check_job_status report not_found while the worker keeps writing.
+        Instead, an active job with *no progress update* for the whole window
+        is presumed crashed and flipped to FAILED — the record stays visible,
+        and the next sweep ages it out through the terminal path.
         """
         cutoff_time = datetime.now() - timedelta(hours=max_age_hours)
         with self.lock:
+            active = (JobStatus.PENDING, JobStatus.RUNNING)
             jobs_to_remove = [
                 job_id for job_id, job in self.jobs.items()
-                if (job.end_time or job.start_time) < cutoff_time
+                if job.status not in active
+                and (job.end_time or job.start_time) < cutoff_time
             ]
             for job_id in jobs_to_remove:
                 del self.jobs[job_id]
+
+            for job in self.jobs.values():
+                if job.status in active:
+                    last_progress = job.last_update_time or job.start_time
+                    if last_progress < cutoff_time:
+                        job.status = JobStatus.FAILED
+                        job.end_time = datetime.now()
+                        if job.errors is None:
+                            job.errors = []
+                        job.errors.append(
+                            f"Presumed crashed: no progress update for {max_age_hours}h"
+                        )

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/core/simulator.py

@@ -48,9 +48,11 @@ class CodeGraphTwin:
         """
         
         # 2. Fetch all relationships originating from nodes in the repository
+        # `*0..` includes the repository node itself (zero-length path), which
+        # replaces the old `WHERE n1 = r OR (r)-[:CONTAINS*]->(n1)` form — a
+        # bare pattern predicate the embedded backends cannot plan (#1512).
         rel_query = """
-        MATCH (r:Repository {path: $path})
-        MATCH (n1) WHERE n1 = r OR (r)-[:CONTAINS*]->(n1)
+        MATCH (r:Repository {path: $path})-[:CONTAINS*0..]->(n1)
         MATCH (n1)-[rel]->(n2)
         RETURN 
           labels(n1)[0] as source_label,

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/core/watcher.py

@@ -458,6 +458,13 @@ class CodeWatcher:
             h.cancel_timers()
         self.handlers.clear()
 
+        # A stopped watchdog Observer cannot be restarted, so the watch state
+        # must not survive it: a stale entry makes watch_directory answer
+        # "Already watching" for a dead observer and the graph silently goes
+        # stale (#1519).
+        self.watched_paths.clear()
+        self.watches.clear()
+
         if self.observer.is_alive():
             self.observer.stop()
             self.observer.join()

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/graph_builder.py

@@ -39,7 +39,7 @@ class GraphBuilder:
     linking for Neo4j, FalkorDB, and Kùzu backends.
     """
 
-    def __init__(self, db_manager: DatabaseManager, job_manager: JobManager, loop: asyncio.AbstractEventLoop):
+    def __init__(self, db_manager: DatabaseManager, job_manager: JobManager, loop: asyncio.AbstractEventLoop, graph_name: str = None):
         """Initialize GraphBuilder.
 
         Parameters
@@ -50,11 +50,16 @@ class GraphBuilder:
             Job manager for tracking indexing progress.
         loop : asyncio.AbstractEventLoop
             Event loop for async operations.
+        graph_name : str, optional
+            Named graph to write into, on backends that support multiple
+            graphs per instance (FalkorDB). None selects the default graph
+            (#1558).
         """
         self.db_manager = db_manager
         self.job_manager = job_manager
         self.loop = loop
-        self._writer = GraphWriter(self.db_manager.get_driver(), db_manager=self.db_manager)
+        self.graph_name = graph_name
+        self._writer = GraphWriter(self.db_manager.get_driver(graph_name), db_manager=self.db_manager)
         self.last_call_resolution_diagnostics: list[Dict[str, Any]] = []
         self.last_index_summary: Dict[str, Any] = {}
         self.parsers = {
@@ -118,8 +123,9 @@ class GraphBuilder:
 
     @property
     def driver(self):
-        """Default graph driver (backward compatible)."""
-        return self.db_manager.get_driver()
+        """Driver for this builder's graph (default graph unless a
+        graph_name was given at construction)."""
+        return self.db_manager.get_driver(self.graph_name)
 
     def _driver_for(self, graph_name: str = None):
         """Get driver for a specific graph, or default."""
@@ -184,21 +190,6 @@ class GraphBuilder:
 
 
     # Language-agnostic method
-    def add_repository_to_graph(self, repo_path: Path, is_dependency: bool = False):
-        """Adds a repository node using its absolute path as the unique key."""
-        repo_name = repo_path.name
-        repo_path_str = repo_path.resolve().as_posix()
-        with self.driver.session() as session:
-            session.run(
-                """
-                MERGE (r:Repository {path: $path})
-                SET r.name = $name, r.is_dependency = $is_dependency
-                """,
-                path=repo_path_str,
-                name=repo_name,
-                is_dependency=is_dependency,
-            )
-
     def add_repository_to_graph(self, repo_path: Path, is_dependency: bool = False) -> None:
         """Add a repository node to the graph.
 

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/handlers/indexing_handlers.py

@@ -20,24 +20,29 @@ def add_code_to_graph(graph_builder, job_manager, loop, list_repos_func, **args)
     if not path:
         return {"error": "Path is a required argument (repo_path)."}
 
-    # `graph_name` is advertised in this tool's schema but indexing cannot yet
-    # honour it: GraphBuilder binds its GraphWriter to the default driver at
-    # construction, so a named graph would need a per-job writer threaded
-    # through the whole pipeline. Refuse explicitly rather than write to the
-    # default graph and report success — an agent that believed the repository
-    # landed in a named graph would find nothing there later, with no error to
-    # explain it.
+    # Indexing into a named graph is supported on multi-graph backends
+    # (FalkorDB): a scoped GraphBuilder is constructed whose writer binds to
+    # get_driver(graph_name). Single-graph backends (KùzuDB/LadybugDB/Neo4j)
+    # would silently ignore the name and land the repo in the default graph —
+    # the exact lie #1558 is about — so those still refuse explicitly.
     graph_name = args.get("graph_name")
     if graph_name:
-        return {
-            "error": (
-                f"Indexing into a named graph is not supported yet, so "
-                f"graph_name={graph_name!r} cannot be honoured. Omit it to index "
-                "into the default graph, or select the graph via the CLI context "
-                "(`cgc context create` / `cgc index --context`)."
-            ),
-            "unsupported_argument": "graph_name",
-        }
+        backend = graph_builder.db_manager.get_backend_type()
+        if backend in ("falkordb", "falkordb-remote"):
+            from ..graph_builder import GraphBuilder
+            graph_builder = GraphBuilder(
+                graph_builder.db_manager, job_manager, loop, graph_name=graph_name
+            )
+        else:
+            return {
+                "error": (
+                    f"The active backend ({backend}) is single-graph, so "
+                    f"graph_name={graph_name!r} cannot be honoured. Omit it to "
+                    "index into the default graph, or select a graph via the CLI "
+                    "context (`cgc context create` / `cgc index --context`)."
+                ),
+                "unsupported_argument": "graph_name",
+            }
     
     try:
         path_obj = Path(path).resolve()
@@ -61,8 +66,10 @@ def add_code_to_graph(graph_builder, job_manager, loop, list_repos_func, **args)
                 "message": f"Path '{path}' does not exist.",
             }
 
-        # Prevent re-indexing the same repository.
-        indexed_repos = list_repos_func().get("repositories", [])
+        # Prevent re-indexing the same repository. list_repos_func reads the
+        # default graph, so the check only applies there — a named graph is a
+        # separate namespace and legitimately re-indexes the same path.
+        indexed_repos = [] if graph_name else list_repos_func().get("repositories", [])
         for repo in indexed_repos:
             if repo_record_matches_path(repo, path_obj):
                 return {
@@ -85,7 +92,9 @@ def add_code_to_graph(graph_builder, job_manager, loop, list_repos_func, **args)
         
         return {
             "success": True, "job_id": job_id,
-            "message": f"Background processing started for {str(path_obj)}",
+            **({"graph_name": graph_name} if graph_name else {}),
+            "message": f"Background processing started for {str(path_obj)}"
+                       + (f" into graph '{graph_name}'" if graph_name else ""),
             "estimated_files": total_files,
             "estimated_duration_seconds": round(estimated_time, 2),
             "estimated_duration_human": f"{int(estimated_time // 60)}m {int(estimated_time % 60)}s" if estimated_time >= 60 else f"{int(estimated_time)}s",

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/indexing/constants.py

@@ -15,6 +15,9 @@ DEFAULT_IGNORE_PATTERNS = [
     "build/",
     "target/",
     "out/",
+    # .NET intermediate output: contains *generated* source (AssemblyInfo.cs,
+    # GlobalUsings.g.cs) that pollutes the graph with phantom modules (#1585).
+    "obj/",
     ".git/",
     "__pycache__/",
     "*.png",

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/indexing/persistence/writer.py

@@ -1138,8 +1138,23 @@ class GraphWriter:
         batch_size = 500
         backend = get_backend_type(self.driver, self._db_manager)
         def _work(session):
-            internal_batch = [r for r in inheritance_batch if r.get("resolved_parent_file_path") != "__external__"]
-            external_batch = [r for r in inheritance_batch if r.get("resolved_parent_file_path") == "__external__"]
+            # Dedupe identical rows first: parsers can emit the same
+            # (child, parent) record more than once, and while Neo4j's MERGE
+            # absorbs the repeat, the embedded backends' rewritten
+            # node-MERGE+rel-MERGE shape has been observed writing a duplicate
+            # INHERITS edge for it. Deduping is correct on every backend.
+            seen_rows: set = set()
+            deduped_batch: List[Dict[str, Any]] = []
+            for r in inheritance_batch:
+                key = (r.get("child_name"), r.get("path"), r.get("parent_name"),
+                       r.get("resolved_parent_file_path"))
+                if key in seen_rows:
+                    continue
+                seen_rows.add(key)
+                deduped_batch.append(r)
+
+            internal_batch = [r for r in deduped_batch if r.get("resolved_parent_file_path") != "__external__"]
+            external_batch = [r for r in deduped_batch if r.get("resolved_parent_file_path") == "__external__"]
 
             labels = ("Class", "Trait", "Interface", "Struct", "Enum", "Union", "Record", "Mixin", "Extension", "Module", "Object", "Variable")
 

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/indexing/pipeline.py

@@ -201,10 +201,32 @@ async def run_tree_sitter_index_async(
             # it to this file's path string turned a single recoverable write
             # failure into an AttributeError that aborted the whole job.
             failed_path = file_data.get("path")
-            write_failures.append({"path": failed_path, "error": str(exc)})
-            error_logger(f"Failed to write {failed_path} to the graph: {exc}")
-            file_data["error"] = str(exc)
-            file_data["parse_failed"] = True
+            # Retry once before giving up: writes are MERGE-idempotent, and a
+            # transient failure under runner load silently costs the graph the
+            # whole file's edges (observed as LadybugDB intermittently writing
+            # ~51 fewer CONTAINS edges in the parity run, #1612).
+            retried_ok = False
+            if "error" not in file_data:
+                try:
+                    await asyncio.sleep(0.2)
+                    await asyncio.to_thread(
+                        writer.add_file_to_graph,
+                        file_data,
+                        repo_name,
+                        imports_map,
+                        repo_path_str=resolved_repo_path_str,
+                    )
+                    retried_ok = True
+                    warning_logger(
+                        f"Write for {failed_path} succeeded on retry after: {exc}"
+                    )
+                except Exception as retry_exc:  # noqa: BLE001
+                    exc = retry_exc
+            if not retried_ok:
+                write_failures.append({"path": failed_path, "error": str(exc)})
+                error_logger(f"Failed to write {failed_path} to the graph: {exc}")
+                file_data["error"] = str(exc)
+                file_data["parse_failed"] = True
 
     if write_failures:
         warning_logger(

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/languages/cpp.py

@@ -519,11 +519,7 @@ class CppTreeSitterParser:
                 if lambda_node is None or lambda_node.type != 'lambda_expression':
                     continue
 
-                params_node = lambda_node.child_by_field_name('declarator')
-                if params_node:
-                    params_node = params_node.child_by_field_name('parameters')
                 name = self._get_node_text(node)
-                params_node = lambda_node.child_by_field_name('parameters')
 
                 context, context_type, _ = self._get_parent_context(assignment_node)
                 class_context, _, _ = self._get_parent_context(assignment_node, types=('class_specifier',))
@@ -532,7 +528,15 @@ class CppTreeSitterParser:
                     "name": name,
                     "line_number": node.start_point[0] + 1,
                     "end_line": assignment_node.end_point[0] + 1,
-                    "args": [p for p in [self._get_node_text(p) for p in params_node.children if p.type == 'identifier'] if p] if params_node else [],
+                    # lambda_expression carries the same declarator→parameters
+                    # field chain as a function_definition, so the shared
+                    # extractor handles parameter_declaration unwrapping
+                    # (pointers/refs included). The old inline version first
+                    # clobbered its correctly-walked parameter_list with a
+                    # nonexistent field and then filtered for bare identifiers
+                    # over parameter_declaration nodes — every lambda got
+                    # args: [] (#1527, case 5).
+                    "args": self._extract_function_params(lambda_node),
                     
                     "docstring": None,
                     "cyclomatic_complexity": 1,

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/languages/javascript.py

@@ -505,38 +505,49 @@ class JavascriptTreeSitterParser:
             if node.type == 'import_statement':
                 source = self._get_node_text(node.child_by_field_name('source')).strip('\'"')
 
-                # Look for different import structures
-                import_clause = node.child_by_field_name('import')
+                # `import_clause` is an unnamed child of import_statement, not a
+                # field, so child_by_field_name('import') always returned None and
+                # every ES import collapsed into the bare-module fallback (#1526).
+                import_clause = next(
+                    (c for c in node.children if c.type == 'import_clause'), None
+                )
                 if not import_clause:
+                    # Side-effect import: import 'polyfill';
                     imports.append({'name': source, 'source': source, 'alias': None, 'line_number': line_number,
                                     'lang': self.language_name})
                     continue
 
-                # Default import: import defaultExport from '...'
-                if import_clause.type == 'identifier':
-                    alias = self._get_node_text(import_clause)
-                    imports.append({'name': 'default', 'source': source, 'alias': alias, 'line_number': line_number,
-                                    'lang': self.language_name})
-
-                # Namespace import: import * as name from '...'
-                elif import_clause.type == 'namespace_import':
-                    alias_node = import_clause.child_by_field_name('alias')
-                    if alias_node:
-                        alias = self._get_node_text(alias_node)
-                        imports.append({'name': '*', 'source': source, 'alias': alias, 'line_number': line_number,
+                # One clause can carry several bindings at once
+                # (import Def, { a as b } from 'mod'), so walk its children.
+                for binding in import_clause.children:
+                    # Default import: import defaultExport from '...'
+                    if binding.type == 'identifier':
+                        alias = self._get_node_text(binding)
+                        imports.append({'name': 'default', 'source': source, 'alias': alias, 'line_number': line_number,
                                         'lang': self.language_name})
 
-                # Named imports: import { name, name as alias } from '...'
-                elif import_clause.type == 'named_imports':
-                    for specifier in import_clause.children:
-                        if specifier.type == 'import_specifier':
-                            name_node = specifier.child_by_field_name('name')
-                            alias_node = specifier.child_by_field_name('alias')
-                            original_name = self._get_node_text(name_node)
-                            alias = self._get_node_text(alias_node) if alias_node else None
-                            imports.append(
-                                {'name': original_name, 'source': source, 'alias': alias, 'line_number': line_number,
-                                 'lang': self.language_name})
+                    # Namespace import: import * as name from '...' — the alias
+                    # is the identifier child (there is no 'alias' field).
+                    elif binding.type == 'namespace_import':
+                        alias = next(
+                            (self._get_node_text(c) for c in binding.children if c.type == 'identifier'),
+                            None,
+                        )
+                        if alias:
+                            imports.append({'name': '*', 'source': source, 'alias': alias, 'line_number': line_number,
+                                            'lang': self.language_name})
+
+                    # Named imports: import { name, name as alias } from '...'
+                    elif binding.type == 'named_imports':
+                        for specifier in binding.children:
+                            if specifier.type == 'import_specifier':
+                                name_node = specifier.child_by_field_name('name')
+                                alias_node = specifier.child_by_field_name('alias')
+                                original_name = self._get_node_text(name_node)
+                                alias = self._get_node_text(alias_node) if alias_node else None
+                                imports.append(
+                                    {'name': original_name, 'source': source, 'alias': alias, 'line_number': line_number,
+                                     'lang': self.language_name})
 
             elif node.type == 'call_expression':  # require('...')
                 args = node.child_by_field_name('arguments')

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/tools/languages/typescript.py

@@ -419,31 +419,49 @@ class TypescriptTreeSitterParser:
             line_number = node.start_point[0] + 1
             if node.type == 'import_statement':
                 source = self._get_node_text(node.child_by_field_name('source')).strip('\'"')
-                import_clause = node.child_by_field_name('import')
+                # `import_clause` is an unnamed child of import_statement, not a
+                # field, so child_by_field_name('import') always returned None and
+                # every ES import collapsed into the bare-module fallback (#1526).
+                import_clause = next(
+                    (c for c in node.children if c.type == 'import_clause'), None
+                )
                 if not import_clause:
+                    # Side-effect import: import 'polyfill';
                     imports.append({'name': source, 'source': source, 'alias': None, 'line_number': line_number,
                                     'lang': self.language_name})
                     continue
-                if import_clause.type == 'identifier':
-                    alias = self._get_node_text(import_clause)
-                    imports.append({'name': 'default', 'source': source, 'alias': alias, 'line_number': line_number,
-                                    'lang': self.language_name})
-                elif import_clause.type == 'namespace_import':
-                    alias_node = import_clause.child_by_field_name('alias')
-                    if alias_node:
-                        alias = self._get_node_text(alias_node)
-                        imports.append({'name': '*', 'source': source, 'alias': alias, 'line_number': line_number,
+
+                # One clause can carry several bindings at once
+                # (import Def, { a as b } from 'mod'), so walk its children.
+                for binding in import_clause.children:
+                    # Default import: import defaultExport from '...'
+                    if binding.type == 'identifier':
+                        alias = self._get_node_text(binding)
+                        imports.append({'name': 'default', 'source': source, 'alias': alias, 'line_number': line_number,
                                         'lang': self.language_name})
-                elif import_clause.type == 'named_imports':
-                    for specifier in import_clause.children:
-                        if specifier.type == 'import_specifier':
-                            name_node = specifier.child_by_field_name('name')
-                            alias_node = specifier.child_by_field_name('alias')
-                            original_name = self._get_node_text(name_node)
-                            alias = self._get_node_text(alias_node) if alias_node else None
-                            imports.append(
-                                {'name': original_name, 'source': source, 'alias': alias, 'line_number': line_number,
-                                 'lang': self.language_name})
+
+                    # Namespace import: import * as name from '...' — the alias
+                    # is the identifier child (there is no 'alias' field).
+                    elif binding.type == 'namespace_import':
+                        alias = next(
+                            (self._get_node_text(c) for c in binding.children if c.type == 'identifier'),
+                            None,
+                        )
+                        if alias:
+                            imports.append({'name': '*', 'source': source, 'alias': alias, 'line_number': line_number,
+                                            'lang': self.language_name})
+
+                    # Named imports: import { name, name as alias } from '...'
+                    elif binding.type == 'named_imports':
+                        for specifier in binding.children:
+                            if specifier.type == 'import_specifier':
+                                name_node = specifier.child_by_field_name('name')
+                                alias_node = specifier.child_by_field_name('alias')
+                                original_name = self._get_node_text(name_node)
+                                alias = self._get_node_text(alias_node) if alias_node else None
+                                imports.append(
+                                    {'name': original_name, 'source': source, 'alias': alias, 'line_number': line_number,
+                                     'lang': self.language_name})
             elif node.type == 'call_expression':
                 args = node.child_by_field_name('arguments')
                 if not args or args.named_child_count == 0: continue

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2}/src/codegraphcontext/utils/cypher_readonly.py

@@ -68,6 +68,31 @@ def _strip_literals_and_comments(query: str) -> str:
     return _LITERAL_OR_COMMENT_RE.sub(" ", query)
 
 
+# A forbidden keyword only functions as a write *clause* in clause position.
+# The same word is inert — and common in real codebases' graphs — when it is:
+#   n.load        a property access        (preceded by '.')
+#   (n:Insert)    a label / rel-type       (preceded by ':')
+#   $update       a parameter name         (preceded by '$')
+#   AS set        a result-column alias    (preceded by the token AS)
+# Only those provably-safe positions are carved out (#1511); anything
+# ambiguous stays rejected, because a false negative here is a write slipping
+# through a read-only gate while a false positive is merely an inconvenience.
+_TOKEN_RE = re.compile(r"\w+|[^\w\s]")
+
+
+def _keyword_in_clause_position(stripped: str, keyword: str) -> bool:
+    tokens = _TOKEN_RE.findall(stripped)
+    kw = keyword.upper()
+    for i, tok in enumerate(tokens):
+        if tok.upper() != kw:
+            continue
+        prev = tokens[i - 1] if i > 0 else ""
+        if prev in (".", ":", "$") or prev.upper() == "AS":
+            continue
+        return True
+    return False
+
+
 def is_read_only_cypher(query: str) -> bool:
     """Return True when *query* has no write keywords outside string literals."""
     if not query or not query.strip():
@@ -76,7 +101,7 @@ def is_read_only_cypher(query: str) -> bool:
     if ";" in stripped:
         return False
     for keyword in _FORBIDDEN_KEYWORDS:
-        if re.search(r"\b" + keyword + r"\b", stripped, re.IGNORECASE):
+        if _keyword_in_clause_position(stripped, keyword):
             return False
     for pattern in _FORBIDDEN_PATTERNS:
         if pattern.search(stripped):

{codegraphcontext-0.6.0 → codegraphcontext-0.6.2/src/codegraphcontext.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraphcontext
-Version: 0.6.0
+Version: 0.6.2
 Summary: An MCP server that indexes local code into a graph database to provide context to AI assistants.
 Author-email: Shashank Shekhar Singh <shashankshekharsingh1205@gmail.com>
 License: MIT License