graphite-code 0.3.0__tar.gz → 0.4.0__tar.gz

{graphite_code-0.3.0 → graphite_code-0.4.0}/CHANGELOG.md

@@ -12,6 +12,84 @@ machine-checkable identity; the version is for humans.
 
 [Keep a Changelog]: https://keepachangelog.com/en/1.1.0/
 
+## [0.4.0] — 2026-08-14
+
+**A minor bump because consumer graphs change, not because an API did.** Both fixes
+below remove or add graph edges, so every consumer that rebuilds will see different
+`callers`/`context` answers and a slightly different Python `calls` ratio. Nothing in
+the CLI or the JSON schema changed. Under this project's pre-1.0 rule — minor versions
+may break things — a patch number would have understated a release that silently
+changes what the graph says.
+
+### Fixed
+
+**Python method calls bound to any same-named definition in the repo, however
+unreachable** (#54). `_resolve_method_dispatch` re-pointed `recv.method()` to any
+`is_method` node sharing the name, justified in its own docstring by "method names
+are almost always globally unique" — true of domain names, false of every name a
+standard library already owns. On graphite's own graph `query "callers resolve"`
+returned **232 callers graded `decision_grade`**, every one an ordinary
+`pathlib.Path(...).resolve()` re-pointed to a test double's `resolve` in
+`tests/test_git_security.py`; `src/graphite/io.py::atomic_write_text` was recorded
+as calling a `write` defined in `tests/test_doctor.py`. The mis-bindings counted as
+`bound`, so the health ratio rose as the defect got worse.
+
+A Python call now dispatches only to a definition in the calling file or in a file
+it directly imports. Filtering happens **before** the ambiguity cap, because
+reachability is the disambiguation that cap was standing in for — so a common name
+with one reachable definition now resolves instead of being abandoned as "too
+generic to guess".
+
+Measured on this repo: `callers resolve` 232 → 5, `callers get` 87 → 0,
+`callers write` 30 → 0; `calls` edges 13498 → 12497 (−1428, +427); `calls.python`
+0.980 → 0.977. Every one of the 1428 dropped edges buckets as
+`src|scripts|tests → tests` or `src → src`, and every sampled member was another
+false binding (`sqlite3.connect`, `Thread.start`, a file handle's `write`).
+
+**Expect consumer graphs to lose call edges and report a slightly lower Python
+`calls` ratio.** That is honest accounting, not a regression — the same shape as the
+constructor-edge change that moved some javascript cells down. Do not "fix" it back.
+
+The gate resolves language through `LANGUAGE_BY_EXT`, the same table `collect_files`
+uses to choose an extractor, so it cannot disagree with the walk that produced the
+edge. Verified to reach a **warm** cache too: a graph built by the old code, rebuilt
+in place by the new code, loses the false binding — the dispatch pass runs after
+`cache.write`, so a stale partition cannot preserve it.
+
+Scoped to **Python only, on evidence**. The gate's premise — "the caller does not
+import the definer" standing in for "the caller cannot be holding one" — is never
+exact in a duck-typed language. TypeScript/JavaScript stay ungated because
+`test_member_call_ambiguous_small_set_links_to_all` pins the documented fan-out on
+an `x: any` receiver with no import at all, a shape the gate would delete; Rust
+because this repo has none to measure. Go could not be gated at all: its in-repo
+imports target a synthesized package id that never equals any file's node id.
+Residual: the same defect survives in ungated JS/TS.
+
+**`import pkg.sub` emitted no import edge to `pkg/__init__.py`** (#55), though that
+statement binds the name `pkg` and executes the package. Every dotted importer was
+therefore invisible as a dependent of that `__init__.py` — the file where re-exports
+and shared constants live, so a high-traffic edit target whose blast radius was
+understated. Silently: a missing edge cannot lower the imports ratio, which is
+computed over the edges that *were* emitted.
+
+Found because the #54 gate refused `pkg.build()` and a test caught it. The gate
+initially compensated with its own ancestor expansion; with the real edges emitted
+that compensation became unfalsifiable — removing it changed no test — so it was
+deleted rather than left looking like protection.
+`test_a_dotted_import_reaches_the_package_it_binds` now guards the coupling.
+
+Measured on this repo: import edges 1890 → 1920 (+30, −0), imports health 740/740 →
+770/770 with `ratio` 1.0 and `external` **unchanged** at 1148 — purely additive, no
+reclassification. `impact src/graphite/routing/__init__.py` went from 1 likely test
+to **8**.
+
+Scoped to `import a.b.c`, not `from a.b import c`. Both execute the package, but only
+the first binds `a`, so only the first can carry a `a.something()` call to attribute;
+the from-import spelling has two existing specifications pinning one edge per module,
+and expanding it would have added ~234 further edges here with no measured demand.
+Ancestors are edged only when they resolve in-repo, so a PEP 420 namespace package
+(no `__init__.py`) and an external `import os.path` both emit nothing extra.
+
 ## [0.3.0] — 2026-08-12
 
 **The first release consumers install as a built wheel.** Through 0.2.1 every

{graphite_code-0.3.0 → graphite_code-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphite-code
-Version: 0.3.0
+Version: 0.4.0
 Summary: Local-first, zero-LLM knowledge graph extraction for codebases.
 Project-URL: Homepage, https://github.com/jared0565/graphite
 Project-URL: Repository, https://github.com/jared0565/graphite

{graphite_code-0.3.0 → graphite_code-0.4.0}/RELEASING.md

@@ -72,12 +72,12 @@ not a harmless duplicate: Hatchling refuses to build a field declared both stati
 and dynamically, so the next build aborts in `_get_version` rather than producing a
 mismatched artifact.
 
-The single source is deliberate. Every consumer here imports from one shared editable
-install, and `importlib.metadata` reports whatever was written into the installed
-metadata at install time — so a version set only in `pyproject.toml` reaches a consumer
-only when someone reinstalls, which routine work never does. `graphite --version` reads
-`graphite.__version__` from the source tree for that reason, and reports a
-`stale-install` line when the installed metadata disagrees.
+The single source is deliberate. `importlib.metadata` reports whatever was written into
+the installed metadata at install time, so a version set only in `pyproject.toml` reaches
+a consumer only when someone reinstalls. `graphite --version` reads
+`graphite.__version__` for that reason, and reports a `stale-install` line when the
+installed metadata disagrees — which is how a development checkout and an installed
+build are told apart at all.
 
 Review the complete diff and confirm no unrelated changes exist, and that
 `pyproject.toml` still declares the version dynamic:
@@ -275,8 +275,34 @@ git push origin vVERSION
 
 Never force push. Publication to PyPI or another index may use only a separately approved
 mechanism from a secure environment with scoped credentials. Never place tokens in
-command-line arguments, shell history, repository files, or logs. This repository and
-guide do not claim that any package index is configured.
+command-line arguments, shell history, repository files, or logs.
+
+**An index IS configured as of 2026-08-14: PyPI, distribution `graphite-code`.**
+Publication runs from `.github/workflows/publish.yml` by Trusted Publishing (OIDC),
+`workflow_dispatch` only. There is no API token in this repository, in any secret, or on
+any maintainer machine — the credential is minted per run and expires in seconds, which
+satisfies the paragraph above by having no long-lived secret to mishandle. The workflow
+publishes the artifacts already attached to the GitHub Release and verifies both SHA256s
+against literals pinned in the reviewed workflow; it never builds. Releasing a new version
+therefore requires editing the approved version and both digests in that file and
+committing the change, so digests pass through review rather than a dispatch form.
+
+After publishing, verify from the INDEX rather than from this checkout:
+
+```text
+python scripts/verify_published_release.py VERSION --wheel-sha256 <from EVIDENCE.md>
+```
+
+Run it BEFORE publishing as well. Every arm must fail while the version does not exist —
+that negative control is what makes the throwaway venv's isolation from this checkout a
+measured fact instead of an assumption.
+
+The digest is the load-bearing arm and the only one that may be omitted. Omitting it is
+legal, and the run then reports `1 arm(s) never ran` and exits 0 having compared no bytes
+— read the arm counts, not just `OVERALL`. An expected digest that is present but is not
+64 hex characters is a FAIL that says `malformed`, which is a different diagnosis from a
+substituted wheel. `tests/test_verify_published_release.py` holds every arm to this,
+including the ones that only fire on a bad release.
 
 ## Retention and rollback
 
@@ -289,11 +315,18 @@ when a rollback is wanted. The store lives at
 rather than as a literal: this file ships inside the sdist, so an absolute path
 here is the maintainer's layout published as if it were policy.
 
-This is not bookkeeping. Consumers import Graphite from a single editable
-install pointed at the development tree, so a saved file is live for all of them
-with no build and no boundary. Rollback means "reinstall the last known-good
-wheel", and that is possible only for a wheel somebody kept. A build directed at
-a scratch directory satisfies the gate above and leaves the gap open.
+This is not bookkeeping. Rollback means "reinstall the last known-good wheel",
+and that is possible only for a wheel somebody kept. A build directed at a
+scratch directory satisfies the gate above and leaves the gap open.
+
+Through 0.2.1 consumers imported Graphite from one shared editable install
+pointed at the development tree, so a saved file was live for all of them with
+no build and no boundary. **That stopped being true at 0.3.0**, which ships as a
+built wheel: `graphite.__file__` resolves under `site-packages` and no editable
+`.pth` survives. The retention rule did not weaken — it got sharper. A fix now
+reaches nobody until a release is cut, so the store is the only record of what
+consumers are actually running, and `index.md`'s "Currently deployed" section is
+the only place that distinguishes it from what is on `main`.
 
 Rolling back, in an environment that already has the runtime dependencies:
 

{graphite_code-0.3.0 → graphite_code-0.4.0}/src/graphite/__init__.py

@@ -38,4 +38,4 @@ __all__ = ["__version__"]
 #: Coarse and hand-maintained by construction. It is a release label, not
 #: evidence that a given fix is present -- to answer that, survey for the marker
 #: the fix introduced, or compare `graphite --version` fingerprints.
-__version__ = "0.3.0"
+__version__ = "0.4.0"

{graphite_code-0.3.0 → graphite_code-0.4.0}/src/graphite/doctor_probes.py

@@ -10,7 +10,7 @@ import sys
 import tempfile
 import threading
 import time
-from collections.abc import Callable
+from collections.abc import Callable, Mapping
 from concurrent.futures import ThreadPoolExecutor
 from functools import lru_cache
 from importlib import machinery, metadata
@@ -490,13 +490,36 @@ _TYPESCRIPT_REMEDIATION = (
 )
 
 
-def _blocked(error_type: str, code: str) -> DoctorCheck:
+def _blocked(error_type: str, code: str, *, masked: Mapping[str, object] | None = None) -> DoctorCheck:
+    """Report one failure, optionally carrying the cause it displaced.
+
+    `masked` is for the one place a result legitimately overrides another: a
+    cleanup failure outranks the primary error, because leaked state is more
+    urgent than a reproducible one. Overriding it must not ERASE it -- reporting
+    only `cleanup_timeout` for a pipeline that exited nonzero sends an operator
+    to temp directories instead of to the build (#53).
+
+    Both carried values come from a fixed vocabulary produced by
+    `_process_error_type` and this module's own literals, so neither can carry a
+    path. That is why they are copied by NAME rather than by merging the
+    displaced details wholesale -- a future detail key holding a path would
+    otherwise be promoted into this report for free.
+    """
+    details: dict[str, object] = {"error_type": error_type, "code": code}
+    if masked is not None:
+        masked_type = masked.get("error_type")
+        masked_code = masked.get("code")
+        # Absent, never null: `masked_error_type: null` would invite a reader to
+        # treat "nothing was displaced" as "something was, and it was nothing".
+        if isinstance(masked_type, str) and isinstance(masked_code, str):
+            details["masked_error_type"] = masked_type
+            details["masked_code"] = masked_code
     return DoctorCheck(
         "deep_core",
         "Deterministic pipeline",
         "blocked",
         "The isolated deterministic pipeline probe failed safely.",
-        {"error_type": error_type, "code": code},
+        details,
         ("Run the Graphite build, validate, and query commands locally and inspect their diagnostics.",),
     )
 
@@ -735,7 +758,18 @@ def probe_core_pipeline(
         if lease is not None:
             cleanup_error = _cleanup_workspace_lease(lease, deadline, _clock)
             if cleanup_error is not None:
-                candidate = _blocked("cleanup", cleanup_error)
+                # Passed unconditionally: `_blocked` carries a cause only when
+                # one is actually present. A probe that SUCCEEDED and then failed
+                # to tear down has details with no `error_type`, so nothing is
+                # carried -- which is the outcome we want.
+                #
+                # An earlier version also tested `candidate.status == "blocked"`
+                # here. It was removed because it could not be shown to guard: it
+                # made `masked` unreachable for a ready candidate, which in turn
+                # made the type check inside `_blocked` unreachable, so each
+                # guard's only effect was to hide the other from every test.
+                displaced = candidate.details if candidate is not None else None
+                candidate = _blocked("cleanup", cleanup_error, masked=displaced)
         else:
             _release_core_probe_slot()
 

{graphite_code-0.3.0 → graphite_code-0.4.0}/src/graphite/extract/ast.py

@@ -11,7 +11,7 @@ from typing import Any, Collection, Final
 
 from ..cache import Cache
 from ..config import Config
-from ..ingest import FileEntry
+from ..ingest import LANGUAGE_BY_EXT, FileEntry
 from ..resolve import SourceIndex, should_keep_call_target
 
 
@@ -1096,6 +1096,37 @@ def _python_import_modules(node: Any) -> list[tuple[str, int]]:
     return out
 
 
+def _python_ancestor_packages(
+    module: str, dots: int, rel_path: str, source_index: SourceIndex | None
+) -> list[str]:
+    """Resolved paths of the in-repo packages `import module` also executes (#55).
+
+    `import pkg.sub` imports `pkg` as well: Python executes `pkg/__init__.py` and
+    binds the ROOT name in the importer, so `pkg.build()` afterwards is a call into
+    the package. Recording only the deepest module made every dotted importer
+    invisible as a dependent of that `__init__.py` -- and a package `__init__.py` is
+    where re-exports and shared constants live, so `impact` understated the blast
+    radius of a high-traffic edit target. Silently: a missing edge cannot lower the
+    imports ratio, which is computed over the edges that WERE emitted.
+
+    Scoped to ancestors that resolve IN-REPO. `import os.path` gains nothing from a
+    second edge to `os`: it would inflate the external count and move the imports
+    ratio for a package that can never be a blast-radius target.
+
+    The counterpart for the other spelling is `_python_from_import_submodules`,
+    added for the mirror-image defect in issue #7.
+    """
+    if source_index is None or "." not in module:
+        return []
+    segments = module.split(".")
+    out: list[str] = []
+    for depth in range(1, len(segments)):
+        resolved = source_index.resolve_python_module(rel_path, ".".join(segments[:depth]), dots)
+        if resolved:
+            out.append(resolved)
+    return out
+
+
 def _python_from_import_submodules(
     node: Any, rel_path: str, source_index: SourceIndex | None
 ) -> list[str]:
@@ -1326,6 +1357,19 @@ def _extract_python(file_id: str, rel_path: str, _source: bytes, tree: Any, sour
                         file_id, _file_node_id(resolved), "imports", rel_path,
                         _line(node), confidence="EXACT_IMPORT",
                     ))
+                    # `import pkg.sub` also imports `pkg` (#55). Deliberately NOT
+                    # applied to `from pkg.sub import x`: that executes the package
+                    # too, but binds only `x`, so there is no `pkg.` call to
+                    # attribute -- and `test_from_import_symbol_only_edge_unchanged`
+                    # pins one edge per module for that spelling.
+                    for ancestor in (
+                        _python_ancestor_packages(module, dots, rel_path, source_index)
+                        if node.type == "import_statement" else ()
+                    ):
+                        result.edges.append(_edge(
+                            file_id, _file_node_id(ancestor), "imports", rel_path,
+                            _line(node), confidence="EXACT_IMPORT",
+                        ))
                 else:
                     result.edges.append(_edge(
                         file_id, _make_id(module) if module else _make_id("package"),
@@ -1838,6 +1882,49 @@ def extract_all(entries: list[FileEntry], cfg: Config, cache: Cache | None = Non
 # edge is left untouched (pre-fix behavior).
 _MAX_METHOD_DISPATCH_CANDIDATES = 3
 
+# Languages where the reachability gate has been MEASURED. Deliberately just
+# Python -- see `_dispatch_is_gated` for why this is not simply "every language
+# whose imports bind to a file node".
+_DISPATCH_GATED_LANGUAGES = frozenset({"python"})
+
+
+def _dispatch_is_gated(source_file: str | None) -> bool:
+    """Whether method dispatch from this file is restricted to reachable definitions.
+
+    Resolved through `LANGUAGE_BY_EXT` -- the same table `collect_files` uses to pick
+    an extractor -- so the gate cannot disagree with the walk that produced the edge.
+    A private suffix list here would agree with that table only by coincidence: `.py`
+    happens to be the sole extension mapping to `python` today, and a `.pyw` or `.pyi`
+    entry added there would silently escape a hardcoded list while still being
+    extracted as Python.
+
+    FAILS OPEN, and the allowlist is narrower than the mechanism can support.
+
+    The gate rests on a proxy: "the caller does not import the definer" standing in
+    for "the caller cannot be holding one of those". That proxy is never exact --
+    every language here is duck-typed or structurally typed, so a function can be
+    handed an instance of a class it never mentions. It is admitted for Python
+    because it was MEASURED there (#54): on this repo it removed 1400+ edges whose
+    every sampled member was a false binding, and added back ~350 real ones that the
+    ambiguity cap had been abandoning.
+
+    TypeScript/JavaScript are NOT gated, on evidence rather than caution.
+    `test_member_call_ambiguous_small_set_links_to_all` pins the documented
+    small-ambiguous-set fan-out using `x: any` and no import at all -- a shape that
+    is idiomatic in TS and that this gate would delete. Rust is ungated for the
+    duller reason that this repo contains none, so nothing here could measure it.
+    Extending the allowlist is a per-language measurement, not a one-line edit.
+
+    Go could not be gated even with evidence: its in-repo imports target a
+    synthesized PACKAGE id (`example_com_repo_store`) that never equals the file
+    node id of any file in that package, and files within one package see each
+    other with no import statement at all.
+    """
+    if not source_file:
+        return False
+    language = LANGUAGE_BY_EXT.get(Path(source_file).suffix.casefold())
+    return language in _DISPATCH_GATED_LANGUAGES
+
 
 def _resolve_method_dispatch(
     nodes: list[dict[str, Any]], edges: list[dict[str, Any]]
@@ -1870,6 +1957,26 @@ def _resolve_method_dispatch(
             methods_by_name.setdefault(n["name"].casefold(), set()).add(n["id"])
     known_ids = {n["id"] for n in nodes}
 
+    # Which file each definition lives in, and which files each file imports
+    # DIRECTLY. Both are needed to answer "could this caller have reached that
+    # definition at all" -- see the reachability filter below (#54).
+    file_of_node: dict[str, str] = {
+        n["id"]: _file_node_id(n["source_file"]) for n in nodes if n.get("source_file")
+    }
+    imports_by_file: dict[str, set[str]] = {}
+    for e in edges:
+        if e.get("relation") == "imports" and e.get("source") and e.get("target"):
+            imports_by_file.setdefault(e["source"], set()).add(e["target"])
+
+    # This gate reads import edges literally, which is only sound while they are
+    # complete. It once carried its own ancestor-package expansion, because
+    # `import pkg.sub` emitted no edge to `pkg/__init__.py` and the gate would
+    # otherwise refuse `pkg.build()` -- a call on the very name that statement
+    # binds. #55 emits that edge, so the compensation became unfalsifiable (removing
+    # it changed no test) and was deleted rather than left looking like protection.
+    # `test_a_dotted_import_reaches_the_package_it_binds` is what now guards the
+    # coupling: it fails if those edges ever stop being emitted.
+
     out: list[dict[str, Any]] = []
     for e in edges:
         method = e.pop("_member", None)  # strip from every edge, resolved or not
@@ -1877,6 +1984,23 @@ def _resolve_method_dispatch(
             out.append(e)
             continue
         candidates = methods_by_name.get(method.casefold())
+        # Reachability gate (#54). A name-only match let `Path(...).resolve()` bind
+        # to a test double's `resolve`, and `f.write(text)` to a `write` defined in
+        # a test file -- 232 and 30 false callers respectively, graded
+        # decision_grade, with the mis-bindings counted as `bound` so the health
+        # ratio rose as the defect got worse. A definition the caller neither
+        # declares nor imports cannot be the receiver's method, whatever its name.
+        # Filtering BEFORE the cap is deliberate: reachability is exactly the
+        # disambiguation the cap was standing in for, so a common name with one
+        # reachable definition now resolves instead of being abandoned as
+        # "too generic to guess".
+        if candidates and _dispatch_is_gated(e.get("source_file")):
+            caller_file = _file_node_id(e["source_file"])
+            reachable = imports_by_file.get(caller_file, frozenset())
+            candidates = {
+                c for c in candidates
+                if file_of_node.get(c) == caller_file or file_of_node.get(c) in reachable
+            }
         if not candidates or len(candidates) > _MAX_METHOD_DISPATCH_CANDIDATES:
             # Member call that resolves to no known definition. Keep it when
             # the target is a real node, or when the call was already

{graphite_code-0.3.0 → graphite_code-0.4.0}/src/graphite/routing/lifecycle_storage.py

@@ -266,7 +266,11 @@ class LifecycleStore:
                 isolation_level=None,
             )
             connection.row_factory = sqlite3.Row
-            connection.execute(f"PRAGMA busy_timeout = {self.busy_timeout_ms}")
+            # PRAGMA accepts no bind parameters, so this cannot be parameterized.
+            # busy_timeout_ms is an int validated to 100..30_000 at construction.
+            # Bare marker, not `nosemgrep: <id>`: semgrep namespaces rule ids by
+            # CONFIG PATH, so the real id embeds this machine's install location.
+            connection.execute(f"PRAGMA busy_timeout = {self.busy_timeout_ms}")  # nosemgrep
             connection.execute("PRAGMA foreign_keys = ON")
             connection.execute("PRAGMA journal_mode = WAL")
             return connection
@@ -342,7 +346,11 @@ class LifecycleStore:
                 isolation_level=None,
             )
             connection.row_factory = sqlite3.Row
-            connection.execute(f"PRAGMA busy_timeout = {self.busy_timeout_ms}")
+            # PRAGMA accepts no bind parameters, so this cannot be parameterized.
+            # busy_timeout_ms is an int validated to 100..30_000 at construction.
+            # Bare marker, not `nosemgrep: <id>`: semgrep namespaces rule ids by
+            # CONFIG PATH, so the real id embeds this machine's install location.
+            connection.execute(f"PRAGMA busy_timeout = {self.busy_timeout_ms}")  # nosemgrep
             connection.execute("PRAGMA foreign_keys = ON")
             connection.execute("PRAGMA query_only = ON")
             version = connection.execute(
@@ -440,6 +448,10 @@ class LifecycleStore:
             ),
         )
         try:
+            # The `# nosemgrep` markers below cover table IDENTIFIER interpolation.
+            # SQL binds values, never identifiers, so a migration that renames and
+            # rebuilds tables cannot use parameters. `table` is not caller input:
+            # `rebuilds` is the literal tuple defined immediately above.
             for table, create_sql, columns in rebuilds:
                 rebuilt = create_sql.replace(
                     f"CREATE TABLE IF NOT EXISTS {table} ",
@@ -449,17 +461,17 @@ class LifecycleStore:
                 if rebuilt == create_sql:
                     raise LifecycleStorageError("lifecycle_migration_failed")
                 connection.execute(rebuilt)
-                connection.execute(
+                connection.execute(  # nosemgrep
                     f"INSERT INTO {table}__v2 ({columns}) SELECT {columns} FROM {table}"
                 )
-                before = connection.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0]
-                after = connection.execute(
+                before = connection.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0]  # nosemgrep
+                after = connection.execute(  # nosemgrep
                     f"SELECT COUNT(*) FROM {table}__v2"
                 ).fetchone()[0]
                 if before != after:
                     raise LifecycleStorageError("lifecycle_migration_quarantined")
-                connection.execute(f"DROP TABLE {table}")
-                connection.execute(f"ALTER TABLE {table}__v2 RENAME TO {table}")
+                connection.execute(f"DROP TABLE {table}")  # nosemgrep
+                connection.execute(f"ALTER TABLE {table}__v2 RENAME TO {table}")  # nosemgrep
             if connection.execute("PRAGMA foreign_key_check").fetchall():
                 raise LifecycleStorageError("lifecycle_migration_quarantined")
             integrity = connection.execute("PRAGMA integrity_check").fetchone()
@@ -501,9 +513,11 @@ class LifecycleStore:
         }
         if not set(expected) <= actual:
             raise LifecycleStorageError("lifecycle_rollback_required")
+        # Identifier interpolation again, and `table` comes from the `expected`
+        # literal above -- never from a caller. PRAGMA takes no bind parameters.
         for table, required_columns in expected.items():
             columns = {
-                str(row[1]) for row in connection.execute(f"PRAGMA table_info({table})")
+                str(row[1]) for row in connection.execute(f"PRAGMA table_info({table})")  # nosemgrep
             }
             if not required_columns <= columns:
                 raise LifecycleStorageError("lifecycle_rollback_required")

{graphite_code-0.3.0 → graphite_code-0.4.0}/src/graphite/routing/storage.py

@@ -902,7 +902,11 @@ class RepositoryStore:
                 isolation_level=None,
             )
             connection.row_factory = sqlite3.Row
-            connection.execute(f"PRAGMA busy_timeout = {self.busy_timeout_ms}")
+            # PRAGMA accepts no bind parameters, so this cannot be parameterized.
+            # busy_timeout_ms is an int validated to 100..30_000 at construction.
+            # Bare marker, not `nosemgrep: <id>`: semgrep namespaces rule ids by
+            # CONFIG PATH, so the real id embeds this machine's install location.
+            connection.execute(f"PRAGMA busy_timeout = {self.busy_timeout_ms}")  # nosemgrep
             connection.execute("PRAGMA foreign_keys = ON")
             connection.execute("PRAGMA journal_mode = WAL")
             return connection
@@ -1245,21 +1249,26 @@ class RepositoryStore:
             )
             connection.execute("PRAGMA foreign_keys=OFF")
             connection.execute("BEGIN IMMEDIATE")
+            # The `# nosemgrep` markers below cover table IDENTIFIER interpolation.
+            # SQL binds values, never identifiers, so a migration that copies and
+            # rebuilds tables cannot use parameters. `table` is not caller input:
+            # `_PRE_V6_WIDENED_TABLES` is a module-level `Final` mapping of two
+            # literal table names.
             for table, (ddl, columns) in _PRE_V6_WIDENED_TABLES.items():
-                before = connection.execute(
+                before = connection.execute(  # nosemgrep
                     f"SELECT COUNT(*) FROM {table}"
                 ).fetchone()[0]
-                connection.execute(
+                connection.execute(  # nosemgrep
                     f"CREATE TABLE {table}_pre_v6_copy AS SELECT * FROM {table}"
                 )
-                connection.execute(f"DROP TABLE {table}")
+                connection.execute(f"DROP TABLE {table}")  # nosemgrep
                 connection.execute(ddl)
                 connection.execute(
                     f"INSERT INTO {table} ({columns}) "
                     f"SELECT {columns} FROM {table}_pre_v6_copy"
                 )
-                connection.execute(f"DROP TABLE {table}_pre_v6_copy")
-                after = connection.execute(
+                connection.execute(f"DROP TABLE {table}_pre_v6_copy")  # nosemgrep
+                after = connection.execute(  # nosemgrep
                     f"SELECT COUNT(*) FROM {table}"
                 ).fetchone()[0]
                 if before != after:
@@ -1318,21 +1327,26 @@ class RepositoryStore:
             )
             connection.execute("PRAGMA foreign_keys=OFF")
             connection.execute("BEGIN IMMEDIATE")
+            # The `# nosemgrep` markers below cover table IDENTIFIER interpolation.
+            # SQL binds values, never identifiers, so a migration that copies and
+            # rebuilds tables cannot use parameters. `table` is not caller input:
+            # `_PRE_V6_WIDENED_TABLES` is a module-level `Final` mapping of two
+            # literal table names.
             for table, (ddl, columns) in _PRE_V6_WIDENED_TABLES.items():
-                before = connection.execute(
+                before = connection.execute(  # nosemgrep
                     f"SELECT COUNT(*) FROM {table}"
                 ).fetchone()[0]
-                connection.execute(
+                connection.execute(  # nosemgrep
                     f"CREATE TABLE {table}_pre_v7_copy AS SELECT * FROM {table}"
                 )
-                connection.execute(f"DROP TABLE {table}")
+                connection.execute(f"DROP TABLE {table}")  # nosemgrep
                 connection.execute(ddl)
                 connection.execute(
                     f"INSERT INTO {table} ({columns}) "
                     f"SELECT {columns} FROM {table}_pre_v7_copy"
                 )
-                connection.execute(f"DROP TABLE {table}_pre_v7_copy")
-                after = connection.execute(
+                connection.execute(f"DROP TABLE {table}_pre_v7_copy")  # nosemgrep
+                after = connection.execute(  # nosemgrep
                     f"SELECT COUNT(*) FROM {table}"
                 ).fetchone()[0]
                 if before != after:
@@ -3263,10 +3277,14 @@ class RepositoryStore:
         return tuple(dict(row) for row in rows)
 
     def row_count(self, table: str) -> int:
+        # The one site here that DOES take a caller-supplied name, which is why the
+        # allowlist below is load-bearing rather than decorative: `table` is
+        # rejected unless it is one of the known table names, and only then reaches
+        # the query. A table identifier cannot be passed as a bind parameter.
         if table not in _TABLES:
             raise ValueError("table_invalid")
         with self._connection() as connection:
-            return int(connection.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0])
+            return int(connection.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0])  # nosemgrep
 
     def save_capability_snapshot_record(self, snapshot: CapabilitySnapshot) -> bool:
         if not isinstance(snapshot, CapabilitySnapshot):