diffctx 1.8.1__tar.gz → 1.10.0__tar.gz

diffctx-1.10.0/CHANGELOG.md

@@ -0,0 +1,200 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.10.0] - 2026-06-20
+
+### Changed
+
+- The default `--tau` (stopping threshold) is now **0.12** across the CLI, MCP,
+  and Python API — the calibrated grid optimum — bringing the Python side in
+  line with the standalone Rust binary (was 0.08). Diff-context selections are
+  slightly tighter by default.
+- The MCP `get_tree_map` / `get_file_context` default `max_file_bytes` is now
+  256 KB, matching the documented CLI default (was 100 KB).
+
+### Fixed
+
+- Document/citation edges can no longer create self-edges (a fragment linking to
+  itself); `Graph::add_edge` now rejects `src == dst`.
+- Test→source import edges no longer match `import` statements that appear inside
+  comments or string literals (the import regex is now line-anchored).
+- The MCP `get_file_context` clipboard confirmation now reports the number of
+  files actually copied, excluding files skipped for exceeding the size cap.
+
+### Docs
+
+- Corrected the AST-parsing language count (was "12 languages", now "30+"),
+  aligned the Rust crate version with the wheel, completed the MCP server README
+  (all three tools documented), and fixed the documented `EGO.per_hop_decay`
+  default (0.5). Documented the `scoring_mode` / `timeout` Python API params,
+  clarified `--budget` / `--tau` help text, and marked the `DIFFCTX_OP_*` /
+  `DIFFCTX_*` tuning env vars as an experimental, non-public interface.
+
+## [1.9.2] - 2026-06-14
+
+### Added
+
+- Private-key and keystore files are now excluded from output in **both** tree
+  mapping and `--diff` context, since such material is never legitimate LLM
+  context: `*.pem`, `*.key`, `*.pfx`, `*.p12`, `*.keystore`, `*.jks`, and SSH
+  private keys `id_rsa`/`id_dsa`/`id_ecdsa`/`id_ed25519` (public `.pub` keys stay
+  visible). The `--diff` path previously applied no ignore filtering at all, so a
+  changed key file would have leaked into context. Use `--no-default-ignores` to
+  opt out of tree-mode default ignores. (`.env` files are intentionally still
+  included — a changed `.env` is legitimate change context; redacting secret
+  *values* is a separate planned content-scan feature.)
+
+### Fixed
+
+- **Diffs touching files larger than 100 KB no longer produce empty output.** A
+  changed file (e.g. a 142 KB `Math.h`) was subject to the same 100 KB cap as
+  context-discovery candidates, so the whole diff yielded "no semantic context".
+  Changed files — the subject of the diff — are now parsed up to 5 MB.
+- **C/C++ symbol names** for variable declarations now report the variable, not
+  the type: a changed `const unsigned blane = …` is labeled `blane`, not
+  `unsigned`. Covers `init`/`array`/pointer/function declarators and C++
+  `reference`/`parenthesized` declarators (`int &r`, `int (*f)()`).
+- Changed-file fragments are no longer dropped by the generated-file reduction
+  (cap of 5 + 30-line content truncation), which could discard the small
+  fragment covering the edited hunk and mislocate the change.
+- Binary detection no longer misclassifies changed text files that embed ANSI
+  escape / control bytes (snapshot and terminal-recording fixtures); it now uses
+  git's NUL-byte heuristic, so such files are no longer silently dropped.
+- Diff-context selection is now deterministic across processes: ego-graph score
+  accumulation, context-fragment capping, and the greedy selection heap use
+  stable tie-breaks, so identical inputs always yield byte-identical output.
+- Python module-import edges are bidirectional (matching every other language
+  and Python's own symbol references), so a changed imported module now
+  propagates relevance back to its importers.
+
+### Hardened
+
+- `git cat-file` blob reads are bounded (drain-and-reject above 16 MB) instead of
+  allocating an arbitrarily large buffer up front.
+
+## [1.9.1] - 2026-06-14
+
+> Supersedes 1.9.0, which was tagged but never published to PyPI (release-process
+> hiccup); 1.9.1 ships the same changes. There is no 1.9.0 on PyPI.
+
+### Added
+
+- Diff-context output now leads with an orientation header — `commit_message`
+  and `changed_files` — in every format (YAML/JSON/Markdown/text), so a reader
+  sees *what* changed before reading any fragment.
+- Each fragment carries a `role` of `changed` when it overlaps the diff hunks
+  (omitted for supporting context). Changed code is emitted first; context
+  follows, ordered by descending per-file relevance instead of alphabetically.
+
+### Changed
+
+- Line-contiguous fragments of the same role within a file are merged into a
+  single entry, cutting the per-fragment scaffolding that dominated output made
+  up of one-line snippets (lossless on line coverage).
+
+### Fixed
+
+- `get_changed_files` and `get_untracked_files` canonicalize paths consistently
+  with deleted/discovered files, preventing duplicate fragments when a tracked
+  path traverses a symlinked directory.
+- Signature extraction no longer terminates at braces inside parameter defaults
+  or annotations (e.g. Python `def f(x={}):`), which previously truncated the
+  signature mid-parameter-list.
+- The post-pass that rescues unrepresented changed files reuses the open
+  `git cat-file --batch` reader instead of spawning a `git show` per file.
+- Degraded token-count fallback returns 0 for the empty string (was 1).
+
+## [1.8.0]
+
+### Added
+
+- Public `diffctx.run(argv=None, *, prog=None, version=None)` engine entry. It
+  is the same execution path as the `diffctx` console script but accepts an
+  injected program name and version string, so a downstream wrapper (e.g. the
+  `treemapper` distribution) can present its own branding in `--help`,
+  `--version`, and error prefixes without duplicating the CLI. `main()` now
+  delegates to `run()` with the default `diffctx` identity — no behavior change
+  for existing callers.
+- `diffctx.mcp.__main__.main(prog=..., extra=...)` accepts an injected program
+  name and install-extra string for the missing-dependency hint, so wrappers
+  can re-expose the MCP entry point with their own name.
+
+## [1.7.0] - 2026-05-22
+
+### Added
+
+- README documents the `graph` subcommand and the `--scoring {ppr,ego,bm25}`
+  flag (default: `ego`); the absolutist "Uses Personalized PageRank" language
+  has been replaced with a table covering all three scoring modes.
+- `SECURITY.md` now ships a "Threat model" section that scopes diffctx as a
+  local CLI (filesystem + git subprocess, no network) and documents that the
+  optional `diffctx-mcp` server confines its filesystem reach via
+  `DIFFCTX_ALLOWED_PATHS`.
+- Footer of `README.md` links `CHANGELOG.md`, `SECURITY.md`, and
+  `docs/parameter-strategy.md` so they are no longer orphaned.
+
+### Changed
+
+- **Package renamed from `treemapper` to `diffctx`.** PyPI distribution, CLI
+  binary, MCP server binary, and Python import path all use `diffctx`. The
+  `treemapper` PyPI package remains at 1.6.1 (frozen); install
+  `diffctx` for all new development. The `TREEMAPPER_ALLOWED_PATHS`
+  environment variable is now `DIFFCTX_ALLOWED_PATHS`.
+- Single source of truth for the package version: the Python wheel reads its
+  version from `Cargo.toml` (via maturin) instead of duplicating it in
+  `pyproject.toml`, eliminating the Rust-crate-vs-Python-package version
+  desync that previously shipped to PyPI.
+- `--diff` now defaults to `HEAD` when no range is supplied, matching the
+  most common invocation (`diffctx . --diff` → diff of the working tree
+  against `HEAD`) and saving an argument in the 30-second demo path.
+- `numpy` moved from a required runtime dependency into the `[tree-sitter]`
+  extra, so default installs no longer pull a ~20 MB scientific stack the
+  core tree-mapping mode does not use.
+- CLI error messages are now actionable: instead of a raw Python traceback,
+  invalid `--diff` ranges, missing git repositories, and unreadable paths
+  print a one-line `Error: <what> — try: <next step>` and exit with code `2`
+  for user-input errors (`1` is reserved for runtime failures).
+- `automerge.yml` GitHub Actions workflow hardened: explicit minimal
+  `permissions:` block, pinned action SHAs, and a guard that refuses to
+  auto-merge anything touching `.github/`, `pyproject.toml`, or `Cargo.toml`.
+
+### Fixed
+
+- Replaced every user-reachable `unwrap()`/`expect()` in the Rust core
+  (`tokenizer.rs`, `git.rs`, `scoring.rs`, `pybridge.rs`) with proper
+  `PyRuntimeError` / `GitError` propagation. A malformed diff, a missing
+  BPE table, or an oversized hunk-header integer no longer aborts the
+  Python interpreter via `panic = "abort"`.
+- `diffctx-mcp` entry point now guards against being launched without the
+  `[mcp]` extra installed and prints an install hint instead of an
+  `ImportError` traceback.
+
+### Removed
+
+- Dropped Kotlin and F# from the language matrix: tree-sitter grammars for
+  both were silently misaligned with the project's import-resolution rules
+  and produced misleading edge weights. They will return once the grammars
+  are vetted.
+
+### Security
+
+- MCP server (`diffctx-mcp`) now refuses to traverse outside the
+  directories listed in `DIFFCTX_ALLOWED_PATHS` (OS-pathsep-separated)
+  and refuses to start if the envvar is unset when run as a network-facing
+  process. See [`SECURITY.md`](SECURITY.md) for the threat model.
+
+## [1.6.1 and earlier]
+
+Earlier releases shipped as `treemapper`; see
+<https://pypi.org/project/treemapper/#history> for legacy versions and
+<https://github.com/nikolay-e/diffctx/releases> for the corresponding GitHub
+release notes (`1.0.0` through `1.6.1`).
+
+[Unreleased]: https://github.com/nikolay-e/diffctx/compare/v1.7.0...HEAD
+[1.7.0]: https://github.com/nikolay-e/diffctx/compare/v1.6.1...v1.7.0

{diffctx-1.8.1 → diffctx-1.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: diffctx
-Version: 1.8.1
+Version: 1.10.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -127,7 +127,7 @@ commit, instead of dumping every changed file in full.*
 [releases page](https://github.com/nikolay-e/diffctx/releases/latest).
 
 > Diff context mode works out of the box. Adding `[tree-sitter]` enables AST-level
-> parsing for more accurate context selection across 12 languages.
+> parsing for more accurate context selection across 30+ languages.
 
 ## Diff Context Mode
 
@@ -170,7 +170,7 @@ emitted, whichever comes first.
 | `--scoring` | `ego`   | Scoring mode: `ego`, `ppr`, or `bm25`                                    |
 | `--budget`  | auto    | Token cap. `auto` lets selection converge; `-1` disables the cap; `N` enforces a fixed cap |
 | `--alpha`   | 0.60    | How tightly context clusters around changes (PPR damping; 0–1, higher = more focused) |
-| `--tau`     | 0.08    | Minimum relevance required to include a fragment (lower = more context)  |
+| `--tau`     | 0.12    | Minimum relevance required to include a fragment (lower = more context)  |
 | `--full`    | false   | Include every changed fragment; skip the smart-selection step entirely   |
 
 Calibration of `--alpha`, `--tau`, and the edge-weight priors is documented
@@ -209,6 +209,7 @@ diffctx . --max-depth 3                  # limit depth
 diffctx . -i custom.ignore               # custom ignore patterns
 
 # diff context mode (requires git repo):
+diffctx . --diff                         # uncommitted changes (working tree vs HEAD)
 diffctx . --diff HEAD~1                  # context for last commit
 diffctx . --diff main..feature           # context for feature branch
 diffctx . --diff HEAD~1 --budget 30000   # limit to ~30k tokens
@@ -302,8 +303,10 @@ ctx = build_diff_context(
                               #  <0  = unlimited (10M-token soft ceiling)
                               #  >0  = explicit token cap
     alpha=0.6,                # PPR damping factor
-    tau=0.08,                 # stopping threshold
+    tau=0.12,                 # stopping threshold
     full=False,               # skip smart selection
+    scoring_mode="ego",       # "ego" (default), "ppr", or "bm25"
+    timeout=300,              # seconds before the pipeline aborts
 )
 yaml_str = to_yaml(ctx)
 ```

{diffctx-1.8.1 → diffctx-1.10.0}/README.md

@@ -50,7 +50,7 @@ commit, instead of dumping every changed file in full.*
 [releases page](https://github.com/nikolay-e/diffctx/releases/latest).
 
 > Diff context mode works out of the box. Adding `[tree-sitter]` enables AST-level
-> parsing for more accurate context selection across 12 languages.
+> parsing for more accurate context selection across 30+ languages.
 
 ## Diff Context Mode
 
@@ -93,7 +93,7 @@ emitted, whichever comes first.
 | `--scoring` | `ego`   | Scoring mode: `ego`, `ppr`, or `bm25`                                    |
 | `--budget`  | auto    | Token cap. `auto` lets selection converge; `-1` disables the cap; `N` enforces a fixed cap |
 | `--alpha`   | 0.60    | How tightly context clusters around changes (PPR damping; 0–1, higher = more focused) |
-| `--tau`     | 0.08    | Minimum relevance required to include a fragment (lower = more context)  |
+| `--tau`     | 0.12    | Minimum relevance required to include a fragment (lower = more context)  |
 | `--full`    | false   | Include every changed fragment; skip the smart-selection step entirely   |
 
 Calibration of `--alpha`, `--tau`, and the edge-weight priors is documented
@@ -132,6 +132,7 @@ diffctx . --max-depth 3                  # limit depth
 diffctx . -i custom.ignore               # custom ignore patterns
 
 # diff context mode (requires git repo):
+diffctx . --diff                         # uncommitted changes (working tree vs HEAD)
 diffctx . --diff HEAD~1                  # context for last commit
 diffctx . --diff main..feature           # context for feature branch
 diffctx . --diff HEAD~1 --budget 30000   # limit to ~30k tokens
@@ -225,8 +226,10 @@ ctx = build_diff_context(
                               #  <0  = unlimited (10M-token soft ceiling)
                               #  >0  = explicit token cap
     alpha=0.6,                # PPR damping factor
-    tau=0.08,                 # stopping threshold
+    tau=0.12,                 # stopping threshold
     full=False,               # skip smart selection
+    scoring_mode="ego",       # "ego" (default), "ppr", or "bm25"
+    timeout=300,              # seconds before the pipeline aborts
 )
 yaml_str = to_yaml(ctx)
 ```

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/Cargo.lock

@@ -194,7 +194,7 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "diffctx"
-version = "1.8.0"
+version = "1.10.0"
 dependencies = [
  "anyhow",
  "clap",

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "diffctx"
-version = "1.8.0"
+version = "1.10.0"
 edition = "2024"
 rust-version = "1.85"
 

diffctx-1.10.0/diffctx/src/config/budget.rs

@@ -0,0 +1,30 @@
+use once_cell::sync::Lazy;
+
+pub struct BudgetConfig {
+    pub unlimited: u32,
+    pub auto_multiplier: f64,
+    pub auto_min: u32,
+    pub auto_max: u32,
+    /// Per-core-fragment ceiling when sizing the auto budget. A core fragment
+    /// that is a whole-file `Chunk` (e.g. a 2000-line unparsed template touched
+    /// by one hunk) would otherwise inflate the budget by its entire byte
+    /// weight, dragging in the whole repo as "context". Capping each core
+    /// fragment's budget contribution decouples "how big are the files I edited"
+    /// from "how much of the repo do I pull in". Does not affect whether the
+    /// changed file is included (it always is) — only the context budget it earns.
+    pub core_token_cap_per_fragment: u32,
+}
+
+impl Default for BudgetConfig {
+    fn default() -> Self {
+        Self {
+            unlimited: 10_000_000,
+            auto_multiplier: 3.0,
+            auto_min: 8_000,
+            auto_max: 48_000,
+            core_token_cap_per_fragment: 1_500,
+        }
+    }
+}
+
+pub static BUDGET: Lazy<BudgetConfig> = Lazy::new(BudgetConfig::default);

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/config/limits.rs

@@ -4,6 +4,7 @@ use crate::config::env_overrides::{read_env_f64, read_env_fraction, read_env_ope
 
 pub struct AlgorithmLimits {
     pub max_file_size: usize,
+    pub max_changed_file_size: usize,
     pub max_fragments: usize,
     pub max_generated_fragments: usize,
     pub max_generated_lines: usize,
@@ -21,6 +22,7 @@ impl Default for AlgorithmLimits {
             .unwrap_or(200);
         Self {
             max_file_size: 100_000,
+            max_changed_file_size: 5_000_000,
             max_fragments,
             max_generated_fragments: 5,
             max_generated_lines: 30,
@@ -31,6 +33,12 @@ impl Default for AlgorithmLimits {
     }
 }
 
+/// Hard ceiling for a single `git cat-file` blob read. Sized with headroom
+/// above `max_changed_file_size` (5 MB) so legitimate large changed files still
+/// load, while a pathological multi-hundred-MB blob is drained and rejected
+/// instead of allocated up front.
+pub const MAX_BLOB_READ_BYTES: usize = 16_000_000;
+
 pub const DEFAULT_PPR_ALPHA: f64 = 0.60;
 /// Calibrated on v1 manifest (2119 instances, 4 benchmarks). Winner
 /// of (tau, cbf) grid = (0.12, 0.5) at min(per_benchmark file_recall)

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/edges/semantic/python.rs

@@ -256,11 +256,13 @@ impl EdgeBuilder for PythonEdgeBuilder {
                         if tgt == &f.id {
                             continue;
                         }
-                        let key = (f.id.clone(), tgt.clone());
-                        let existing = edges.get(&key).copied().unwrap_or(0.0);
-                        if PYTHON_SEMANTIC.import_weight > existing {
-                            edges.insert(key, PYTHON_SEMANTIC.import_weight);
-                        }
+                        base::add_edge(
+                            &mut edges,
+                            &f.id,
+                            tgt,
+                            PYTHON_SEMANTIC.import_weight,
+                            PYTHON_SEMANTIC.reverse_factor,
+                        );
                     }
                 }
             }

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/edges/structural/testing.rs

@@ -11,7 +11,7 @@ use super::super::EdgeDict;
 use super::super::base::{self, EdgeBuilder, add_edge_unidirectional, path_to_module};
 
 static IMPORT_RE: Lazy<Regex> =
-    Lazy::new(|| Regex::new(r"(?:from\s+([\w.]+)\s+import|import\s+([\w.]+))").unwrap());
+    Lazy::new(|| Regex::new(r"(?m)^\s*(?:from\s+([\w.]+)\s+import|import\s+([\w.]+))").unwrap());
 
 fn is_python_test(name: &str) -> bool {
     name.starts_with("test_") || name.ends_with("_test.py")

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/filtering.rs

@@ -143,9 +143,8 @@ fn find_hub_noise_paths(graph: &Graph, changed_paths: &FxHashSet<Arc<str>>) -> F
 
     noise_counts
         .into_iter()
-        .filter(|(p, count)| {
-            *count >= 1
-                && !direct_edge_paths.contains(p)
+        .filter(|(p, _count)| {
+            !direct_edge_paths.contains(p)
                 && !changed_dirs.contains(
                     &Path::new(p.as_ref())
                         .parent()
@@ -290,7 +289,7 @@ pub fn cap_context_fragments(
             file_frags.sort_by(|a, b| {
                 let sa = rel.get(&a.id).copied().unwrap_or(0.0);
                 let sb = rel.get(&b.id).copied().unwrap_or(0.0);
-                sb.partial_cmp(&sa).unwrap_or(std::cmp::Ordering::Equal)
+                sb.total_cmp(&sa).then_with(|| a.id.cmp(&b.id))
             });
             result.extend(
                 file_frags
@@ -300,5 +299,6 @@ pub fn cap_context_fragments(
         }
     }
 
+    result.sort_by(|a, b| a.id.cmp(&b.id));
     result
 }

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/fragmentation.rs

@@ -14,7 +14,11 @@ use crate::parsers::fragment_file;
 use crate::tokenizer::count_tokens;
 use crate::types::{Fragment, FragmentId, FragmentKind, extract_identifiers};
 
-static BINARY_CTRL_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"[\x00-\x08\x0e-\x1f]").unwrap());
+// Content reaching here is already-decoded UTF-8 text, so the only reliable
+// binary signal is an embedded NUL (matching git's own heuristic). The old
+// range flagged ESC/BS/etc., wrongly dropping changed text fixtures that embed
+// ANSI escape codes (snapshot/terminal-recording files).
+static BINARY_CTRL_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"\x00").unwrap());
 
 static GENERATED_FILENAME_PATTERNS: Lazy<FxHashSet<&'static str>> = Lazy::new(|| {
     [
@@ -193,6 +197,7 @@ fn read_file_content(
     root_dir: &Path,
     preferred_revs: &[String],
     mut batch_reader: Option<&mut CatFileBatch>,
+    is_changed: bool,
 ) -> Option<String> {
     let ext = file_path
         .extension()
@@ -208,7 +213,11 @@ fn read_file_content(
         .unwrap_or_else(|_| root_dir.to_path_buf());
     let rel = abs_path.strip_prefix(&resolved_root).ok()?;
 
-    let max_size = LIMITS.max_file_size;
+    let max_size = if is_changed {
+        LIMITS.max_changed_file_size
+    } else {
+        LIMITS.max_file_size
+    };
     for rev in preferred_revs {
         if let Some(reader) = batch_reader.as_deref_mut() {
             match reader.get(rev, rel) {
@@ -229,7 +238,7 @@ fn read_file_content(
 
     if abs_path.exists() && abs_path.is_file() {
         if let Ok(meta) = std::fs::metadata(&abs_path) {
-            if meta.len() as usize > LIMITS.max_file_size {
+            if meta.len() as usize > max_size {
                 return None;
             }
         }
@@ -249,6 +258,7 @@ pub fn process_files_for_fragments(
     preferred_revs: &[String],
     seen_frag_ids: &mut FxHashSet<FragmentId>,
     mut batch_reader: Option<&mut CatFileBatch>,
+    is_changed: bool,
 ) -> Vec<Fragment> {
     let max_frags = LIMITS.max_fragments;
     let max_generated = LIMITS.max_generated_fragments;
@@ -267,6 +277,7 @@ pub fn process_files_for_fragments(
                     root_dir,
                     preferred_revs,
                     batch_reader.as_deref_mut(),
+                    is_changed,
                 )?;
                 Some((file_path.clone(), content))
             })
@@ -277,7 +288,11 @@ pub fn process_files_for_fragments(
                 .map(|(file_path, content)| {
                     let path_arc: Arc<str> = Arc::from(file_path.to_string_lossy().as_ref());
                     let mut raw_frags = fragment_file(path_arc, content);
-                    let generated = is_generated_file(file_path, content);
+                    // Changed files are the subject of the diff: never apply the
+                    // aggressive generated-file reduction (cap=5 + 30-line content
+                    // truncation), which can drop the small fragment covering the
+                    // edited hunk before core identification runs.
+                    let generated = !is_changed && is_generated_file(file_path, content);
                     let cap = if generated { max_generated } else { max_frags };
                     if raw_frags.len() > cap {
                         raw_frags.sort_by(|a, b| b.line_count().cmp(&a.line_count()));
@@ -310,7 +325,7 @@ pub fn create_whole_file_fragment(
     preferred_revs: &[String],
     batch_reader: Option<&mut CatFileBatch>,
 ) -> Option<Fragment> {
-    let content = read_file_content(path, root_dir, preferred_revs, batch_reader)?;
+    let content = read_file_content(path, root_dir, preferred_revs, batch_reader, true)?;
     let trimmed = content.trim();
     if trimmed.is_empty() {
         return None;

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/git.rs

@@ -376,7 +376,15 @@ pub fn get_changed_files(repo_root: &Path, diff_range: Option<&str>) -> Result<V
         args.push(range);
     }
     let parts = run_git_z(repo_root, &args)?;
-    Ok(parts.iter().map(|p| repo_root.join(p)).collect())
+    Ok(parts
+        .iter()
+        .map(|p| {
+            repo_root
+                .join(p)
+                .canonicalize()
+                .unwrap_or_else(|_| repo_root.join(p))
+        })
+        .collect())
 }
 
 pub fn get_deleted_files(repo_root: &Path, diff_range: Option<&str>) -> Result<FxHashSet<PathBuf>> {
@@ -481,7 +489,15 @@ pub fn get_untracked_files(repo_root: &Path) -> Result<Vec<PathBuf>> {
         repo_root,
         &["ls-files", "--others", "--exclude-standard", "-z"],
     )?;
-    Ok(parts.iter().map(|p| repo_root.join(p)).collect())
+    Ok(parts
+        .iter()
+        .map(|p| {
+            repo_root
+                .join(p)
+                .canonicalize()
+                .unwrap_or_else(|_| repo_root.join(p))
+        })
+        .collect())
 }
 
 pub struct CatFileBatch {
@@ -578,6 +594,28 @@ impl CatFileBatch {
             GitError::CommandFailed(format!("cat-file: invalid size in header: {}", header_str))
         })?;
 
+        // Guard against allocating an unbounded blob. Anything larger than the
+        // biggest size we will ever parse is drained from the stream in bounded
+        // chunks (to keep the cat-file pipe in sync for the next request) and
+        // rejected, instead of allocating `size` bytes up front (OOM on a
+        // pathological multi-hundred-MB blob).
+        if size > crate::config::limits::MAX_BLOB_READ_BYTES {
+            let mut remaining = size;
+            let mut scratch = [0u8; 65536];
+            while remaining > 0 {
+                let want = remaining.min(scratch.len());
+                reader.read_exact(&mut scratch[..want])?;
+                remaining -= want;
+            }
+            let mut trailing = [0u8; 1];
+            let _ = reader.read_exact(&mut trailing);
+            return Err(GitError::CommandFailed(format!(
+                "cat-file: blob too large ({} bytes): {}",
+                size,
+                spec.trim()
+            )));
+        }
+
         let mut content = vec![0u8; size];
         reader.read_exact(&mut content)?;
 

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/graph.rs

@@ -113,6 +113,9 @@ impl Graph {
         if weight.is_nan() || weight.is_infinite() || weight <= 0.0 {
             return;
         }
+        if src == dst {
+            return;
+        }
         debug_assert!(
             self.csr_cache.is_none(),
             "add_edge called after Graph was frozen"
@@ -230,10 +233,11 @@ impl Graph {
             return FxHashMap::default();
         }
 
-        let valid_seed_idxs: Vec<u32> = seeds
+        let mut valid_seed_idxs: Vec<u32> = seeds
             .iter()
             .filter_map(|s| fwd.node_to_idx.get(s).copied())
             .collect();
+        valid_seed_idxs.sort_unstable();
 
         let per_seed: Vec<Vec<(u32, u32, f64)>> = valid_seed_idxs
             .par_iter()

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/interval.rs

@@ -45,10 +45,12 @@ impl IntervalIndex {
                 continue;
             }
             // Strict `>`: a fragment starting on the very last line of an
-            // already-selected fragment is adjacent, not overlapping. Compact
-            // languages (Rust/Go/Scala one-liners, Lisp `}{` chains) routinely
-            // produce back-to-back fragments sharing exactly that boundary
-            // line; treating it as overlap silently drops the next fragment.
+            // already-selected fragment shares exactly one boundary line. We
+            // deliberately tolerate that one-line overlap rather than drop the
+            // candidate, because compact languages (Rust/Go/Scala one-liners,
+            // Lisp `}{` chains) routinely produce back-to-back fragments sharing
+            // that boundary line; rejecting them would silently discard the
+            // next fragment's unique content for the sake of one duplicated line.
             if end > frag.start_line() {
                 return true;
             }

{diffctx-1.8.1 → diffctx-1.10.0}/diffctx/src/memory_pipeline.rs

@@ -165,7 +165,20 @@ pub fn build_diff_context_in_memory(
     );
 
     let dummy_root = Path::new(".");
-    build_diff_context_output(dummy_root, &selected, no_content)
+    let mut changed_list: Vec<String> = changed_paths.iter().cloned().collect();
+    changed_list.sort();
+    let change = crate::render::ChangeSummary {
+        commit_message: None,
+        changed_files: changed_list,
+    };
+    build_diff_context_output(
+        dummy_root,
+        &selected,
+        no_content,
+        &core_ids,
+        &scoring_result.rel_scores,
+        change,
+    )
 }
 
 fn compute_memory_hunks(
@@ -323,6 +336,8 @@ fn empty_output(name: &str) -> DiffContextOutput {
     DiffContextOutput {
         name: name.to_string(),
         output_type: "diff_context".to_string(),
+        commit_message: None,
+        changed_files: Vec::new(),
         fragment_count: 0,
         fragments: Vec::new(),
         latency: None,