graphite-code 1.0.1__tar.gz → 1.1.1__tar.gz

{graphite_code-1.0.1 → graphite_code-1.1.1}/CHANGELOG.md

@@ -13,6 +13,241 @@ machine-checkable identity; the version is for humans.
 
 [Keep a Changelog]: https://keepachangelog.com/en/1.1.0/
 
+## [Unreleased]
+
+## [1.1.1] — 2026-10-03
+
+A patch release. Security fixes ship in the next patch release of the current
+minor (`docs/compatibility.md`, `SECURITY.md`). The graph itself does not
+change: on this repository, measured against the deployed 1.1.0 engine,
+7797 of 7797 node ids survive, 22154 of 22154 edge triples are
+unchanged, every relation count is equal, and `analysis.cycles` is identical.
+Only the engine fingerprint moves, because graphite's own bytes did.
+
+### Security
+
+**graphite no longer launches a program by bare name, so a program sitting in
+a repository root cannot run in place of the real one.** On Windows a bare
+name is looked up in the launching process's current directory before PATH.
+That covers a list-form `subprocess.run(["git", ...])`, cmd.exe and
+`shutil.which`, unless `NoDefaultCurrentDirectoryInExePath` is set. Claude
+Code sets that variable, but the daemon at login and a commit from a terminal
+do not.
+
+graphite's builds, hooks and channel broker run with a repository root as
+their current directory. A `node.exe` committed to a TypeScript repo's root
+ran on every build, and the build still exited 0. This was measured against
+the released 1.1.0 wheel; channel round 304 reported it.
+
+Every launch now goes through `graphite.programs.resolve_program`, which:
+
+- reads only absolute PATH entries;
+- skips a PATH directory inside the target repository, or one that IS the
+  current directory, judged both as written and as resolved, so a committed
+  symlink cannot choose which outside binary runs (aramid llm-review
+  `1d8d8cf`);
+- refuses any candidate that resolves into one of those;
+- on Windows, tries `.exe` as CreateProcess does, unless the caller asks for
+  more.
+
+Windows' own tools come from the system directory the OS reports. The
+sites changed are:
+
+- the TypeScript bridge's `node` (every build);
+- the channel broker's `git`;
+- the channel's commit-msg hook, which fails closed when no git is found;
+- the `git` calls in `init` and `hookinstall`;
+- `daemon-health`'s `powershell.exe`;
+- the four `schtasks.exe` calls;
+- the Startup launcher's `powershell.exe`;
+- routing's `claude`/`codex` lookup, which keeps `.cmd` shims, excludes the
+  repository and the task worktree whatever the current directory (aramid
+  llm-review `30e2473`), and sets the CLI's environment (see below);
+- `doctor`'s `graphite-mcp` check;
+- the mutation-test launcher's `git`.
+
+Resolving the first program is not enough when that program is a `.cmd` shim.
+An npm-installed CLI with no `node.exe` beside it runs bare `node` through
+cmd.exe, which searches the task worktree first. A `node.exe` committed to the
+repo would then run before the CLI's own sandbox. Routing now sets
+`NoDefaultCurrentDirectoryInExePath=1` in every CLI's environment, which turns
+that search off for the whole chain. The commit-msg hook also has its own status
+when it cannot find git. It used to fall through to "this commit names no agent".
+
+Two older private copies of the same PATH walk, in `git` and `doctor`, now
+delegate to the shared resolver. A test walks every launch call in `src/`,
+`scripts/` and the hook's embedded program, and fails on a program named by a
+literal or on `shell=True`.
+
+The current directory is refused itself, not its subtree, because that is
+what Windows searches. Refusing everything beneath it would refuse every tool
+on drive C for a run started from `C:\`, and `~/.local/bin` or an
+nvm-installed `node` for a run started from `$HOME`. A pre-release build
+measured exactly that. The repository's own subtree is refused through the
+repository each caller passes.
+
+Artifacts already installed keep the old command until they are regenerated:
+- the Startup `.vbs` (`graphite daemon-install-startup-windows`);
+- the channel's commit-msg hook (rewritten by `graphite channel register`).
+
+### Fixed
+
+**`doctor --deep`'s LLM probe no longer spends the provider's timeout on
+starting its worker.** One number was both the provider timeout and the worker
+process's whole budget. The interpreter's start was therefore paid from the
+provider's time, and a loaded machine reported `timeout` for a provider that
+was only misconfigured: 2 s read `timeout` 7 times in 10 under 36 CPU burners.
+
+The worker already enforces the provider timeout itself. Its process budget is
+now that timeout plus `_LLM_WORKER_START_ALLOWANCE_SECONDS` (30 s), which only
+bounds a worker that never answers. A 0.1 s provider timeout, below any
+interpreter's start, now reaches `configuration`.
+
+**The channel reports an abandoned lock on every path that can break one.**
+These come from aramid llm-review findings:
+- **`1810f9e`:** `inbox()`, the path every agent takes at session start, was
+  the one writer that dropped the recovery. `graphite_channel_inbox` now
+  carries `lock_recovered` when a delivery had to break a lock, and stays
+  silent otherwise.
+- **`9751aab`:** a residue scan that failed read as `[]`, the same as a clean
+  one. It now reads `null`, meaning "we could not look". A wedged git, the
+  likeliest cause of an abandoned lock, is also what makes the scan fail.
+- **`9a23b84`:** the recovery report no longer returns the dead holder's host
+  name. Nothing decides on it: identity is pid + start time, and staleness is
+  the clock.
+
+**The channel's commit-msg hook is installed with exactly `0o755`, pinned on
+every platform.** aramid's mutation drain found `0o755 -> 0o756`, a
+world-writable audit hook on POSIX, surviving (`e37afd86`). On Windows,
+`os.chmod` honours only the write bit, so no on-disk check there could see it.
+A test now pins the argument, which kills the mutant on Windows too. A
+POSIX-only test checks the on-disk property: executable, and not group- or
+world-writable.
+
+## [1.1.0] — 2026-09-27
+
+A minor release. The agent channel's read surfaces gain fields, which is an
+addition under `docs/compatibility.md`. The channel's audit trail also
+closes three holes: status events taken on trust, deletions nobody saw, and
+an audit gate that could fail open. The graph itself does not change. On
+this repository, measured against the deployed 1.0.1 engine, 7659 of
+7659 node ids survive, 21788 of 21788 edge triples are unchanged, every
+relation count is equal, and `analysis.cycles` is identical. Only the
+engine fingerprint moves, because graphite's own bytes did.
+
+### Added
+
+**Every channel status now says who recorded it, and where each recipient
+stands.** `graphite_channel_list`, `graphite_channel_read` and `graphite
+channel list --json` carry `status_actor`, `status_at` and
+`status_verification` beside `status`, plus `recipients` (each recipient's
+own latest status and its verification, or `null`) and `unreceipted`
+(recipients with no event of any kind). `status` keeps its
+meaning: the newest event by any agent. `graphite_channel_read` also returns
+`history`, where every event carries its actor, time, commit and
+verification grade. `graphite channel show N` prints the same history after
+the body. Measured on the live channel on 2026-09-25: the one folded word
+misstated at least one recipient in 39 of the 212 rounds that carry events.
+Round 256 read `acknowledged` while one of its two recipients had recorded
+nothing. The read tool's description now says that reading records nothing,
+and that `graphite_channel_inbox` registers receipt.
+
+### Fixed
+
+**The channel report now verifies status events against their commits, as it
+already did for rounds.** A status event's `actor` was taken on trust. An
+event written by hand under another agent's trailer, rewritten after its
+commit, or edited and left uncommitted was invisible, because the forged
+actor was a participant and the file was tracked. Each event is now graded
+from one `git log` over `status/`. It is `verified` only when it has exactly
+one commit, a clean working copy, and a trailer naming its actor.
+`status_modified`, `status_discrepancy` and `status_uncommitted` are
+anomalies and fail `ok`. On the live channel all 408 events verified, with
+a planted-forgery control flagged. A comment had claimed this check existed.
+The read surfaces carry the same grade, so an actor is never shown bare:
+`status_verification` sits beside `status_actor`, each recipient's entry has
+its own `verification`, and the human report marks a failing attribution
+`UNVERIFIED`. This closes aramid llm-review finding `53368ee`.
+One trust limit remains, and it is stated here because it bounds what
+"verified" means. Every agent commits under the operator's git identity, so
+a trailer proves which agent label was attached, not which process
+committed. A hand-made commit under the claimed actor's own trailer still
+grades `verified`. Closing that needs signed commits.
+
+**The channel report now sees deletions, and a status event's number is
+never reused.** The report graded only the events and rounds still on disk,
+and a new event took `len(files) + 1`. An agent could therefore delete its
+own `blocked` event, commit the deletion, write a `done` into the same slot,
+and the report still read OK. A round file removed the same way vanished
+from the audit view entirely. The next number is now one past the highest
+the round has ever used, on disk or in history, and a history git cannot
+read refuses the write instead of passing for an empty one. Any status file
+or round that history or the index knows but the working tree lacks is
+reported as `status_deleted` or `round_deleted`, and a hole in a round's
+1..N sequence is reported as `status_seq_gap`. All three fail `ok`. The live channel's history
+holds no deletions or renames, so none fire there. This closes aramid
+llm-review finding `5db5889`.
+
+**Installing the channel's audit gate now fails closed.**
+`ensure_channel_hook` set `core.hooksPath` with `check=False` and always
+reported `changed: True`. A gate git never armed (a locked `.git/config`, or a
+higher-precedence override) was therefore reported as in place, and later
+commits would have passed with no agent trailer. The write now raises on
+failure. The value git will actually use is read back, and anything other
+than `.githooks` raises `hook_not_armed`. `changed` reports the observed
+before-and-after state. This closes aramid llm-review finding `0e87805`.
+
+**Stalling is judged per recipient.** A co-recipient's `done` no longer
+hides a recipient that was handed the round and never followed up. A
+withdrawn or superseded round never stalls. Rows gain `stalled_recipients`.
+The report lists recipients with no receipt per agent under `unreceipted`.
+They are visible but do not fail `ok`, because several registered agents
+have never called inbox, and a check that is always red is one nobody
+reads.
+
+**Reading the channel no longer rewrites its git index.** The report's
+`git status` refreshed stale stat data by rewriting `.git/index` under
+`index.lock`, the lock a concurrent broker `git add` needs. Channel git now
+runs with `GIT_OPTIONAL_LOCKS=0`. A test pins the index bytes across a
+report and a read with stale stat data.
+
+**A PEP 508 marker of the shape `(A) or (B)` was mis-parsed by the doctor's
+MCP distribution walk.** The marker evaluator unwrapped outer parentheses by
+checking only that the text started with `(` and ended with `)`, so
+`(extra == "a") or (python_version == "3.14")` was stripped to
+`extra == "a") or (python_version == "3.14"`. An `extra` marker of that shape
+then failed closed to "does not apply"; a plain marker of that shape raised
+and aborted the whole distribution walk, which is `probe_mcp`'s manifest
+source. Outer parentheses are now unwrapped only when the first `(` is closed
+by the last character, counting depth outside quoted values. Found by the
+new `tests/test_doctor_probes.py`; no installed distribution on the reference
+machine carried the shape, which is why the walk had never failed.
+
+### Changed
+
+**`scripts/mutation_tests.py` targets `scripts/` changes too.** The
+certifying launcher for aramid's mutation gate diffed `src/` only, so a
+mutant in the launcher itself skipped the targeted stage and its confirm ran
+the whole suite (465 s on the gate's first live drain, 2026-09-04, where the
+targeted stage kills in seconds). A changed `scripts/<stem>.py` now targets
+`tests/test_<stem>.py` and `tests/test_<stem>_*.py` like a changed source
+module.
+
+**Twelve modules gained a `tests/test_<stem>.py`.** aramid's mutation stage 1
+runs `tests/test_<module>.py` when it exists and otherwise `pytest -k
+<module>`; a run that selects nothing is booked a stage-1 survivor and every
+such mutant goes to a full-suite confirm, of which an item gets three. Nine
+modules had a `-k` fallback that collected zero tests (`doctor_probes`,
+`dependency_install`, `probe_process`, `ts_bridge`, `_win32_ctypes`,
+`process_contracts`, `routing/ollama_executor`, `routing/context_builder`,
+`routing/route_pool_execution`) and three collected one (`mcp_server`,
+`llm_probe`, `cluster`). Each now has a stage-1 file that pins its pure
+helpers directly; every file was proven able to fail by a hand mutant of its
+module. Three quirks were pinned as-is rather than changed: a cluster's
+kind label is `f"{kind}s"` verbatim (`classs`), a blank path in a TypeScript
+bridge edge normalises to `.` instead of being dropped, and an empty MCP
+`node_id` fuzzy-matches the first node.
+
 ## [1.0.1] — 2026-09-05
 
 A patch release. Measured against the deployed 1.0.0 engine on this repository,

{graphite_code-1.0.1 → graphite_code-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphite-code
-Version: 1.0.1
+Version: 1.1.1
 Summary: Local-first, zero-LLM knowledge graph extraction for codebases.
 Project-URL: Homepage, https://github.com/jared0565/graphite
 Project-URL: Repository, https://github.com/jared0565/graphite
@@ -48,7 +48,7 @@ Description-Content-Type: text/markdown
 
 Local-first, deterministic knowledge graph extraction for codebases — zero-LLM, daemon-maintained, agent-agnostic.
 
-**Status: 1.0.1, production/stable.** Published on PyPI as
+**Status: 1.1.1, production/stable.** Published on PyPI as
 [`graphite-code`](https://pypi.org/project/graphite-code/) with PEP 740
 attestations; supported on Windows, Linux and macOS with Python 3.11–3.14
 (every cell gates CI). What 1.x promises — CLI, JSON outputs, `graph.json`,

{graphite_code-1.0.1 → graphite_code-1.1.1}/README.md

@@ -2,7 +2,7 @@
 
 Local-first, deterministic knowledge graph extraction for codebases — zero-LLM, daemon-maintained, agent-agnostic.
 
-**Status: 1.0.1, production/stable.** Published on PyPI as
+**Status: 1.1.1, production/stable.** Published on PyPI as
 [`graphite-code`](https://pypi.org/project/graphite-code/) with PEP 740
 attestations; supported on Windows, Linux and macOS with Python 3.11–3.14
 (every cell gates CI). What 1.x promises — CLI, JSON outputs, `graph.json`,

{graphite_code-1.0.1 → graphite_code-1.1.1}/src/graphite/__init__.py

@@ -38,4 +38,4 @@ __all__ = ["__version__"]
 #: Coarse and hand-maintained by construction. It is a release label, not
 #: evidence that a given fix is present -- to answer that, survey for the marker
 #: the fix introduced, or compare `graphite --version` fingerprints.
-__version__ = "1.0.1"
+__version__ = "1.1.1"