codenib 0.2.1__tar.gz → 0.2.2__tar.gz

{codenib-0.2.1 → codenib-0.2.2}/CHANGELOG.md

@@ -11,6 +11,43 @@ All notable user-facing changes are recorded here. CodeNib follows
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-08-21
+
+### Added
+
+- Persistent, exact repository-relative source exclusions through
+  `--exclude-dir` and `--clear-exclude-dirs`, with one recorded policy reused
+  by CodeGraph, indexing, MCP, Wiki, Web, and public compiler entry points.
+- Manifest 1.2 source-selection identities and builder receipts, while retaining
+  strict read compatibility for manifest 1.1 artifacts.
+- Authenticated optional SCIP occurrence-sidecar receipts bound to the same
+  owned symbol-graph generation as `graph.pkl`.
+
+### Changed
+
+- Authenticated indexing now accepts absolute symbolic links only when their
+  lexical target remains inside the same pinned repository authority. Expo,
+  CocoaPods, and pnpm-style contained link layouts no longer require a broad
+  default-ignore rule.
+- CodeGraph status reports the effective source selection, and Wiki, publish,
+  doctor, and toolchain flows reuse it instead of silently widening the source
+  surface.
+- Manifest-bound C and C++ queries temporarily use the verified persisted
+  symbol graph instead of consuming project-local clangd postings directly.
+
+### Security
+
+- Source paths, graph artifacts, native query routes, and retained manifests
+  are checked against the same authenticated source selection before they can
+  be published or served. Unproven native routes fail closed to the persisted
+  graph.
+- Zoekt builds use a fixed commit-tree contract, private generation
+  publication, and an authenticated shard-tree receipt; custom exclusions are
+  rejected until the backend can prove that narrower surface end to end.
+- Authenticated MCP `search_zoekt` serving uses a retained Linux `/proc`
+  descriptor snapshot. Other platforms fail closed until they have an
+  equivalent immutable runtime handoff.
+
 ## [0.2.1] - 2026-08-14
 
 ### Added
@@ -156,7 +193,8 @@ All notable user-facing changes are recorded here. CodeNib follows
 - Prepared secretless PyPI publishing through a dedicated GitHub Actions OIDC
   workflow.
 
-[Unreleased]: https://github.com/sysevol-ai/CodeNib/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/sysevol-ai/CodeNib/compare/v0.2.2...HEAD
+[0.2.2]: https://github.com/sysevol-ai/CodeNib/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/sysevol-ai/CodeNib/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/sysevol-ai/CodeNib/compare/v0.1.0...v0.2.0
 [0.2.0a2]: https://github.com/sysevol-ai/CodeNib/compare/620a82d...78e12ac

{codenib-0.2.1 → codenib-0.2.2}/MANIFEST.in

@@ -3,6 +3,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 graft web
+include native/workspace_owner.c
 include CHANGELOG.md
 include CONTRIBUTING.md
 include server.json

{codenib-0.2.1 → codenib-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codenib
-Version: 0.2.1
+Version: 0.2.2
 Summary: A multi-view data system for serving repository context to coding agents
 Author-email: Zhongming Yu <zhy025@ucsd.edu>
 License-Expression: Apache-2.0
@@ -143,15 +143,17 @@ SPDX-License-Identifier: Apache-2.0
   </p>
   <p>
     <a href="https://github.com/sysevol-ai/CodeNib/actions/workflows/ci-full.yml"><img src="https://github.com/sysevol-ai/CodeNib/actions/workflows/ci-full.yml/badge.svg" alt="CI"></a>
-    <a href="https://pypi.org/project/codenib/"><img src="https://img.shields.io/pypi/v/codenib.svg" alt="PyPI version"></a>
+    <a href="https://pypi.org/project/codenib/"><img src="https://img.shields.io/pypi/v/codenib.svg?cacheSeconds=300" alt="PyPI version"></a>
+    <a href="https://docs.codenib.ai/codegraph/#one-command-setup"><img src="https://img.shields.io/badge/Claude_Code-D97757?logo=claude&amp;logoColor=fff" alt="Claude Code supported"></a>
+    <a href="https://docs.codenib.ai/codegraph/#one-command-setup"><img src="https://img.shields.io/badge/Codex-000?logo=openai&amp;logoColor=fff" alt="Codex supported"></a>
     <a href="https://github.com/sysevol-ai/CodeNib/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache 2.0"></a>
     <a href="https://github.com/sysevol-ai/CodeNib/blob/main/pyproject.toml"><img src="https://img.shields.io/badge/Python-3.10%2B-3776AB.svg" alt="Python 3.10+"></a>
-    <img src="https://img.shields.io/badge/Release-0.2.1-2563EB.svg" alt="CodeNib 0.2.1">
+    <img src="https://img.shields.io/badge/Release-0.2.2-2563EB.svg" alt="CodeNib 0.2.2">
   </p>
 </div>
 
 ```bash
-python -m pip install "codenib[graph,mcp]==0.2.1"
+python -m pip install "codenib[graph,mcp]==0.2.2"
 codenib codegraph init /path/to/your/repo
 ```
 
@@ -163,6 +165,11 @@ does not write configuration or indexes into the target repository.
 
 ## News
 
+- **2026-08-21 — CodeNib 0.2.2 repository source authority.** Authenticated
+  indexing now admits absolute symlinks only when they resolve inside the same
+  pinned checkout, and exact root-relative exclusions persist across indexing,
+  CodeGraph, MCP, Wiki, and Web runtimes.
+  [Release notes](https://docs.codenib.ai/releases/0.2.2/)
 - **2026-08-13 — CodeNib 0.2.1 CodeGraph onboarding.** One command prepares a
   repository graph and connects it to Codex and Claude Code, with idempotent
   status, safe uninstall, and installed-wheel MCP graph verification.
@@ -196,23 +203,23 @@ does not write configuration or indexes into the target repository.
 
 | Layer | Responsibility |
 |---|---|
-| Incremental compiler | Chunk source and materialize BM25, dense, graph, and navigation views; reuse or repair supported artifacts and rebuild when an update cannot be admitted |
+| View compiler | Chunk source and materialize BM25, dense, graph, and navigation views; reuse current artifacts and atomically rebuild affected views |
 | View manifest | Record repository identity, source fingerprint, builder profile, capabilities, status, and artifact location independently for each view |
 | Context serving | Execute lexical, semantic, hybrid, reranked, and structural query plans while preserving repository-relative source locations |
 | Agent runtime | Expose capability-aware MCP and LSP-shaped tools, assemble bounded evidence, and return citations that agents and humans can inspect |
 
 ```text
 repository change
-  -> materialize or repair affected views
+  -> reuse current views or rebuild affected views
   -> publish a capability-bearing manifest
   -> plan repository queries
   -> deliver bounded, source-linked context
 ```
 
-On a later commit, CodeNib can reuse unchanged vector content and patch
-supported graph transitions at file or symbol granularity. Unsupported,
-inconsistent, or unverified transitions fall back to a fresh build instead of
-publishing a partially updated view.
+On a later commit, CodeNib reuses views whose source and builder identities are
+still current. A requested view affected by source or policy changes currently
+rebuilds in an isolated generation; file- and symbol-level delta repair remains
+disabled until it can use the same pinned source authority.
 
 ## Quickstart
 
@@ -220,7 +227,7 @@ Requires Python 3.10+ and Git. For an agent-ready CodeGraph with no model or API
 key, install the graph and MCP extras and run one command:
 
 ```bash
-python -m pip install "codenib[graph,mcp]==0.2.1"
+python -m pip install "codenib[graph,mcp]==0.2.2"
 codenib codegraph init /path/to/repository
 ```
 
@@ -231,16 +238,42 @@ Run `codenib codegraph status /path/to/repository` to diagnose the complete
 path or `codenib codegraph uninstall /path/to/repository` to remove only the
 managed client registrations. The index remains reusable.
 
+Repositories can persist exact root-relative subtree exclusions when generated
+or vendored content should not be indexed:
+
+```bash
+codenib codegraph init /path/to/repository \
+  --exclude-dir ios/Pods \
+  --exclude-dir generated/api
+```
+
+Paths use repository-relative POSIX spelling (`/`) and name exact subtrees,
+not globs. Repeat `--exclude-dir` to replace the complete custom exclusion set. Later
+`init` and `index` runs reuse that policy from the manifest; use
+`--clear-exclude-dirs` to return to the default source surface. CodeNib does not
+implicitly treat `.gitignore` as an indexing policy, because tracked and local
+ignored source can still be intentional input.
+
+Zoekt supports the default source policy only when its fixed commit tree
+exactly matches the authenticated checkout and contains no tracked path that
+the default policy excludes. It does not currently support a non-empty custom
+exclusion set. A command that explicitly requests the `zoekt` view, including
+`--preset full`, fails closed when either condition is unmet; use the
+CodeGraph, `fast`, or semantic paths instead.
+In 0.2.2 the authenticated MCP `search_zoekt` runtime requires Linux `/proc`
+so the child process can inherit the exact retained shard generation; other
+platforms fail closed instead of reopening a mutable shard path.
+
 For a browser Wiki with hybrid BM25+dense retrieval, install the semantic extra:
 
 ```bash
-python -m pip install "codenib[semantic]==0.2.1"
+python -m pip install "codenib[semantic]==0.2.2"
 codenib wiki /path/to/repository
 ```
 
 Both paths keep reusable state under `~/.codenib/repositories` and leave the
 target checkout unchanged. Set `CODENIB_HOME` to relocate state. The
-[0.2.1 release notes](https://docs.codenib.ai/releases/0.2.1/) record the
+[0.2.2 release notes](https://docs.codenib.ai/releases/0.2.2/) record the
 upgrade boundary and installed-product evidence.
 
 Preview the CodeGraph operations without installing, indexing, or configuring
@@ -255,7 +288,7 @@ only their package-level providers; operating-system and project prerequisites
 remain explicit:
 
 ```bash
-python -m pip install "codenib[graph]==0.2.1"
+python -m pip install "codenib[graph]==0.2.2"
 codenib toolchain install /path/to/repository --scope graph
 codenib doctor /path/to/repository --require graph
 ```
@@ -273,7 +306,7 @@ provider credential; interactive Ask and runtime graph exploration remain on
 the local or MCP serving path.
 
 For a repository-hosted Wiki, CodeNib also ships a reusable GitHub workflow
-that incrementally builds the same manifest, deploys the static site to Pages,
+that builds or reuses the same manifest, deploys the static site to Pages,
 and uploads the matching commit-addressed context artifact. Its default
 `semantic` route builds BM25 and vector views with a cached local Hugging Face
 model and needs no API key. An explicit `fast` route avoids the model download;
@@ -297,7 +330,7 @@ The recommended path configures installed Codex and Claude Code clients through
 their native CLIs:
 
 ```bash
-python -m pip install "codenib[graph,mcp]==0.2.1"
+python -m pip install "codenib[graph,mcp]==0.2.2"
 codenib codegraph init /path/to/repository
 ```
 
@@ -327,7 +360,7 @@ capabilities, loaded views, fusion, graph, and reranking trace.
 
 | Surface | Purpose |
 |---|---|
-| Incremental compiler | Build independently managed views, reuse unchanged content, repair supported transitions, and conservatively rebuild outside those boundaries |
+| View compiler | Build independently managed views, reuse current generations, and atomically rebuild changed views under one source identity |
 | Agent context runtime | Plan capability-aware retrieval and navigation, then assemble bounded source-linked evidence |
 | Retrieval | BM25, dense-vector, regex/trigram, Zoekt, fusion, and reranking paths; see the [validated model matrix](https://docs.codenib.ai/rag_ops/#validated-models) |
 | Structural context | SCIP/LSP-backed symbol graphs with source locations and typed edges |
@@ -376,8 +409,8 @@ running the credential- or toolchain-dependent tiers.
 
 ## Status
 
-CodeNib `0.1.0` is a developer preview. The CLI and manifest format are usable,
-but public interfaces may still change before a stable release. Historical
+CodeNib `0.2.2` is a beta release. The CLI and manifest format are usable, but
+public interfaces may still change before a stable release. Historical
 research artifacts retain their published dataset identifiers; the maintained
 package, import namespace, commands, and repository use `CodeNib`. See
 [Naming](https://docs.codenib.ai/branding/).

{codenib-0.2.1 → codenib-0.2.2}/README.md

@@ -34,15 +34,17 @@ SPDX-License-Identifier: Apache-2.0
   </p>
   <p>
     <a href="https://github.com/sysevol-ai/CodeNib/actions/workflows/ci-full.yml"><img src="https://github.com/sysevol-ai/CodeNib/actions/workflows/ci-full.yml/badge.svg" alt="CI"></a>
-    <a href="https://pypi.org/project/codenib/"><img src="https://img.shields.io/pypi/v/codenib.svg" alt="PyPI version"></a>
+    <a href="https://pypi.org/project/codenib/"><img src="https://img.shields.io/pypi/v/codenib.svg?cacheSeconds=300" alt="PyPI version"></a>
+    <a href="https://docs.codenib.ai/codegraph/#one-command-setup"><img src="https://img.shields.io/badge/Claude_Code-D97757?logo=claude&amp;logoColor=fff" alt="Claude Code supported"></a>
+    <a href="https://docs.codenib.ai/codegraph/#one-command-setup"><img src="https://img.shields.io/badge/Codex-000?logo=openai&amp;logoColor=fff" alt="Codex supported"></a>
     <a href="https://github.com/sysevol-ai/CodeNib/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache 2.0"></a>
     <a href="https://github.com/sysevol-ai/CodeNib/blob/main/pyproject.toml"><img src="https://img.shields.io/badge/Python-3.10%2B-3776AB.svg" alt="Python 3.10+"></a>
-    <img src="https://img.shields.io/badge/Release-0.2.1-2563EB.svg" alt="CodeNib 0.2.1">
+    <img src="https://img.shields.io/badge/Release-0.2.2-2563EB.svg" alt="CodeNib 0.2.2">
   </p>
 </div>
 
 ```bash
-python -m pip install "codenib[graph,mcp]==0.2.1"
+python -m pip install "codenib[graph,mcp]==0.2.2"
 codenib codegraph init /path/to/your/repo
 ```
 
@@ -54,6 +56,11 @@ does not write configuration or indexes into the target repository.
 
 ## News
 
+- **2026-08-21 — CodeNib 0.2.2 repository source authority.** Authenticated
+  indexing now admits absolute symlinks only when they resolve inside the same
+  pinned checkout, and exact root-relative exclusions persist across indexing,
+  CodeGraph, MCP, Wiki, and Web runtimes.
+  [Release notes](https://docs.codenib.ai/releases/0.2.2/)
 - **2026-08-13 — CodeNib 0.2.1 CodeGraph onboarding.** One command prepares a
   repository graph and connects it to Codex and Claude Code, with idempotent
   status, safe uninstall, and installed-wheel MCP graph verification.
@@ -87,23 +94,23 @@ does not write configuration or indexes into the target repository.
 
 | Layer | Responsibility |
 |---|---|
-| Incremental compiler | Chunk source and materialize BM25, dense, graph, and navigation views; reuse or repair supported artifacts and rebuild when an update cannot be admitted |
+| View compiler | Chunk source and materialize BM25, dense, graph, and navigation views; reuse current artifacts and atomically rebuild affected views |
 | View manifest | Record repository identity, source fingerprint, builder profile, capabilities, status, and artifact location independently for each view |
 | Context serving | Execute lexical, semantic, hybrid, reranked, and structural query plans while preserving repository-relative source locations |
 | Agent runtime | Expose capability-aware MCP and LSP-shaped tools, assemble bounded evidence, and return citations that agents and humans can inspect |
 
 ```text
 repository change
-  -> materialize or repair affected views
+  -> reuse current views or rebuild affected views
   -> publish a capability-bearing manifest
   -> plan repository queries
   -> deliver bounded, source-linked context
 ```
 
-On a later commit, CodeNib can reuse unchanged vector content and patch
-supported graph transitions at file or symbol granularity. Unsupported,
-inconsistent, or unverified transitions fall back to a fresh build instead of
-publishing a partially updated view.
+On a later commit, CodeNib reuses views whose source and builder identities are
+still current. A requested view affected by source or policy changes currently
+rebuilds in an isolated generation; file- and symbol-level delta repair remains
+disabled until it can use the same pinned source authority.
 
 ## Quickstart
 
@@ -111,7 +118,7 @@ Requires Python 3.10+ and Git. For an agent-ready CodeGraph with no model or API
 key, install the graph and MCP extras and run one command:
 
 ```bash
-python -m pip install "codenib[graph,mcp]==0.2.1"
+python -m pip install "codenib[graph,mcp]==0.2.2"
 codenib codegraph init /path/to/repository
 ```
 
@@ -122,16 +129,42 @@ Run `codenib codegraph status /path/to/repository` to diagnose the complete
 path or `codenib codegraph uninstall /path/to/repository` to remove only the
 managed client registrations. The index remains reusable.
 
+Repositories can persist exact root-relative subtree exclusions when generated
+or vendored content should not be indexed:
+
+```bash
+codenib codegraph init /path/to/repository \
+  --exclude-dir ios/Pods \
+  --exclude-dir generated/api
+```
+
+Paths use repository-relative POSIX spelling (`/`) and name exact subtrees,
+not globs. Repeat `--exclude-dir` to replace the complete custom exclusion set. Later
+`init` and `index` runs reuse that policy from the manifest; use
+`--clear-exclude-dirs` to return to the default source surface. CodeNib does not
+implicitly treat `.gitignore` as an indexing policy, because tracked and local
+ignored source can still be intentional input.
+
+Zoekt supports the default source policy only when its fixed commit tree
+exactly matches the authenticated checkout and contains no tracked path that
+the default policy excludes. It does not currently support a non-empty custom
+exclusion set. A command that explicitly requests the `zoekt` view, including
+`--preset full`, fails closed when either condition is unmet; use the
+CodeGraph, `fast`, or semantic paths instead.
+In 0.2.2 the authenticated MCP `search_zoekt` runtime requires Linux `/proc`
+so the child process can inherit the exact retained shard generation; other
+platforms fail closed instead of reopening a mutable shard path.
+
 For a browser Wiki with hybrid BM25+dense retrieval, install the semantic extra:
 
 ```bash
-python -m pip install "codenib[semantic]==0.2.1"
+python -m pip install "codenib[semantic]==0.2.2"
 codenib wiki /path/to/repository
 ```
 
 Both paths keep reusable state under `~/.codenib/repositories` and leave the
 target checkout unchanged. Set `CODENIB_HOME` to relocate state. The
-[0.2.1 release notes](https://docs.codenib.ai/releases/0.2.1/) record the
+[0.2.2 release notes](https://docs.codenib.ai/releases/0.2.2/) record the
 upgrade boundary and installed-product evidence.
 
 Preview the CodeGraph operations without installing, indexing, or configuring
@@ -146,7 +179,7 @@ only their package-level providers; operating-system and project prerequisites
 remain explicit:
 
 ```bash
-python -m pip install "codenib[graph]==0.2.1"
+python -m pip install "codenib[graph]==0.2.2"
 codenib toolchain install /path/to/repository --scope graph
 codenib doctor /path/to/repository --require graph
 ```
@@ -164,7 +197,7 @@ provider credential; interactive Ask and runtime graph exploration remain on
 the local or MCP serving path.
 
 For a repository-hosted Wiki, CodeNib also ships a reusable GitHub workflow
-that incrementally builds the same manifest, deploys the static site to Pages,
+that builds or reuses the same manifest, deploys the static site to Pages,
 and uploads the matching commit-addressed context artifact. Its default
 `semantic` route builds BM25 and vector views with a cached local Hugging Face
 model and needs no API key. An explicit `fast` route avoids the model download;
@@ -188,7 +221,7 @@ The recommended path configures installed Codex and Claude Code clients through
 their native CLIs:
 
 ```bash
-python -m pip install "codenib[graph,mcp]==0.2.1"
+python -m pip install "codenib[graph,mcp]==0.2.2"
 codenib codegraph init /path/to/repository
 ```
 
@@ -218,7 +251,7 @@ capabilities, loaded views, fusion, graph, and reranking trace.
 
 | Surface | Purpose |
 |---|---|
-| Incremental compiler | Build independently managed views, reuse unchanged content, repair supported transitions, and conservatively rebuild outside those boundaries |
+| View compiler | Build independently managed views, reuse current generations, and atomically rebuild changed views under one source identity |
 | Agent context runtime | Plan capability-aware retrieval and navigation, then assemble bounded source-linked evidence |
 | Retrieval | BM25, dense-vector, regex/trigram, Zoekt, fusion, and reranking paths; see the [validated model matrix](https://docs.codenib.ai/rag_ops/#validated-models) |
 | Structural context | SCIP/LSP-backed symbol graphs with source locations and typed edges |
@@ -267,8 +300,8 @@ running the credential- or toolchain-dependent tiers.
 
 ## Status
 
-CodeNib `0.1.0` is a developer preview. The CLI and manifest format are usable,
-but public interfaces may still change before a stable release. Historical
+CodeNib `0.2.2` is a beta release. The CLI and manifest format are usable, but
+public interfaces may still change before a stable release. Historical
 research artifacts retain their published dataset identifiers; the maintained
 package, import namespace, commands, and repository use `CodeNib`. See
 [Naming](https://docs.codenib.ai/branding/).

{codenib-0.2.1 → codenib-0.2.2}/codenib/__init__.py

@@ -16,6 +16,8 @@ from ._lazy import exported_dir, load_export
 from ._version import __version__
 
 if TYPE_CHECKING:  # pragma: no cover - imported only by static analyzers
+    from codenib._captured_directory import PublishedWorkspaceReceiptOwner
+    from codenib._local_workspace_provider import LocalWorkspaceProvider
     from codenib.agent.extract_agent import KeywordExtractor
     from codenib.agent.rerank_agent import RerankAgent
     from codenib.code_chunker import CodeChunker, RepoChunkingConfig
@@ -30,6 +32,14 @@ if TYPE_CHECKING:  # pragma: no cover - imported only by static analyzers
     from codenib.search import CodeSearchEngine
 
 _EXPORTS = {
+    "PublishedWorkspaceReceiptOwner": (
+        "codenib._captured_directory",
+        "PublishedWorkspaceReceiptOwner",
+    ),
+    "LocalWorkspaceProvider": (
+        "codenib._local_workspace_provider",
+        "LocalWorkspaceProvider",
+    ),
     "LSIndexer": ("codenib.ls_router", "LSIndexer"),
     "CodeGraph": ("codenib.graph.code_graph", "CodeGraph"),
     "BM25CodeIndexer": (
@@ -54,6 +64,8 @@ _EXPORTS = {
 
 __all__ = [
     "__version__",
+    "PublishedWorkspaceReceiptOwner",
+    "LocalWorkspaceProvider",
     "LSIndexer",
     "CodeGraph",
     "BM25CodeIndexer",