graphite-code 1.1.0__tar.gz → 1.1.1__tar.gz

{graphite_code-1.1.0 → graphite_code-1.1.1}/CHANGELOG.md

@@ -15,6 +15,115 @@ machine-checkable identity; the version is for humans.
 
 ## [Unreleased]
 
+## [1.1.1] — 2026-10-03
+
+A patch release. Security fixes ship in the next patch release of the current
+minor (`docs/compatibility.md`, `SECURITY.md`). The graph itself does not
+change: on this repository, measured against the deployed 1.1.0 engine,
+7797 of 7797 node ids survive, 22154 of 22154 edge triples are
+unchanged, every relation count is equal, and `analysis.cycles` is identical.
+Only the engine fingerprint moves, because graphite's own bytes did.
+
+### Security
+
+**graphite no longer launches a program by bare name, so a program sitting in
+a repository root cannot run in place of the real one.** On Windows a bare
+name is looked up in the launching process's current directory before PATH.
+That covers a list-form `subprocess.run(["git", ...])`, cmd.exe and
+`shutil.which`, unless `NoDefaultCurrentDirectoryInExePath` is set. Claude
+Code sets that variable, but the daemon at login and a commit from a terminal
+do not.
+
+graphite's builds, hooks and channel broker run with a repository root as
+their current directory. A `node.exe` committed to a TypeScript repo's root
+ran on every build, and the build still exited 0. This was measured against
+the released 1.1.0 wheel; channel round 304 reported it.
+
+Every launch now goes through `graphite.programs.resolve_program`, which:
+
+- reads only absolute PATH entries;
+- skips a PATH directory inside the target repository, or one that IS the
+  current directory, judged both as written and as resolved, so a committed
+  symlink cannot choose which outside binary runs (aramid llm-review
+  `1d8d8cf`);
+- refuses any candidate that resolves into one of those;
+- on Windows, tries `.exe` as CreateProcess does, unless the caller asks for
+  more.
+
+Windows' own tools come from the system directory the OS reports. The
+sites changed are:
+
+- the TypeScript bridge's `node` (every build);
+- the channel broker's `git`;
+- the channel's commit-msg hook, which fails closed when no git is found;
+- the `git` calls in `init` and `hookinstall`;
+- `daemon-health`'s `powershell.exe`;
+- the four `schtasks.exe` calls;
+- the Startup launcher's `powershell.exe`;
+- routing's `claude`/`codex` lookup, which keeps `.cmd` shims, excludes the
+  repository and the task worktree whatever the current directory (aramid
+  llm-review `30e2473`), and sets the CLI's environment (see below);
+- `doctor`'s `graphite-mcp` check;
+- the mutation-test launcher's `git`.
+
+Resolving the first program is not enough when that program is a `.cmd` shim.
+An npm-installed CLI with no `node.exe` beside it runs bare `node` through
+cmd.exe, which searches the task worktree first. A `node.exe` committed to the
+repo would then run before the CLI's own sandbox. Routing now sets
+`NoDefaultCurrentDirectoryInExePath=1` in every CLI's environment, which turns
+that search off for the whole chain. The commit-msg hook also has its own status
+when it cannot find git. It used to fall through to "this commit names no agent".
+
+Two older private copies of the same PATH walk, in `git` and `doctor`, now
+delegate to the shared resolver. A test walks every launch call in `src/`,
+`scripts/` and the hook's embedded program, and fails on a program named by a
+literal or on `shell=True`.
+
+The current directory is refused itself, not its subtree, because that is
+what Windows searches. Refusing everything beneath it would refuse every tool
+on drive C for a run started from `C:\`, and `~/.local/bin` or an
+nvm-installed `node` for a run started from `$HOME`. A pre-release build
+measured exactly that. The repository's own subtree is refused through the
+repository each caller passes.
+
+Artifacts already installed keep the old command until they are regenerated:
+- the Startup `.vbs` (`graphite daemon-install-startup-windows`);
+- the channel's commit-msg hook (rewritten by `graphite channel register`).
+
+### Fixed
+
+**`doctor --deep`'s LLM probe no longer spends the provider's timeout on
+starting its worker.** One number was both the provider timeout and the worker
+process's whole budget. The interpreter's start was therefore paid from the
+provider's time, and a loaded machine reported `timeout` for a provider that
+was only misconfigured: 2 s read `timeout` 7 times in 10 under 36 CPU burners.
+
+The worker already enforces the provider timeout itself. Its process budget is
+now that timeout plus `_LLM_WORKER_START_ALLOWANCE_SECONDS` (30 s), which only
+bounds a worker that never answers. A 0.1 s provider timeout, below any
+interpreter's start, now reaches `configuration`.
+
+**The channel reports an abandoned lock on every path that can break one.**
+These come from aramid llm-review findings:
+- **`1810f9e`:** `inbox()`, the path every agent takes at session start, was
+  the one writer that dropped the recovery. `graphite_channel_inbox` now
+  carries `lock_recovered` when a delivery had to break a lock, and stays
+  silent otherwise.
+- **`9751aab`:** a residue scan that failed read as `[]`, the same as a clean
+  one. It now reads `null`, meaning "we could not look". A wedged git, the
+  likeliest cause of an abandoned lock, is also what makes the scan fail.
+- **`9a23b84`:** the recovery report no longer returns the dead holder's host
+  name. Nothing decides on it: identity is pid + start time, and staleness is
+  the clock.
+
+**The channel's commit-msg hook is installed with exactly `0o755`, pinned on
+every platform.** aramid's mutation drain found `0o755 -> 0o756`, a
+world-writable audit hook on POSIX, surviving (`e37afd86`). On Windows,
+`os.chmod` honours only the write bit, so no on-disk check there could see it.
+A test now pins the argument, which kills the mutant on Windows too. A
+POSIX-only test checks the on-disk property: executable, and not group- or
+world-writable.
+
 ## [1.1.0] — 2026-09-27
 
 A minor release. The agent channel's read surfaces gain fields, which is an

{graphite_code-1.1.0 → graphite_code-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: graphite-code
-Version: 1.1.0
+Version: 1.1.1
 Summary: Local-first, zero-LLM knowledge graph extraction for codebases.
 Project-URL: Homepage, https://github.com/jared0565/graphite
 Project-URL: Repository, https://github.com/jared0565/graphite
@@ -48,7 +48,7 @@ Description-Content-Type: text/markdown
 
 Local-first, deterministic knowledge graph extraction for codebases — zero-LLM, daemon-maintained, agent-agnostic.
 
-**Status: 1.1.0, production/stable.** Published on PyPI as
+**Status: 1.1.1, production/stable.** Published on PyPI as
 [`graphite-code`](https://pypi.org/project/graphite-code/) with PEP 740
 attestations; supported on Windows, Linux and macOS with Python 3.11–3.14
 (every cell gates CI). What 1.x promises — CLI, JSON outputs, `graph.json`,

{graphite_code-1.1.0 → graphite_code-1.1.1}/README.md

@@ -2,7 +2,7 @@
 
 Local-first, deterministic knowledge graph extraction for codebases — zero-LLM, daemon-maintained, agent-agnostic.
 
-**Status: 1.1.0, production/stable.** Published on PyPI as
+**Status: 1.1.1, production/stable.** Published on PyPI as
 [`graphite-code`](https://pypi.org/project/graphite-code/) with PEP 740
 attestations; supported on Windows, Linux and macOS with Python 3.11–3.14
 (every cell gates CI). What 1.x promises — CLI, JSON outputs, `graph.json`,

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/__init__.py

@@ -38,4 +38,4 @@ __all__ = ["__version__"]
 #: Coarse and hand-maintained by construction. It is a release label, not
 #: evidence that a given fix is present -- to answer that, survey for the marker
 #: the fix introduced, or compare `graphite --version` fingerprints.
-__version__ = "1.1.0"
+__version__ = "1.1.1"

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/channel.py

@@ -34,6 +34,8 @@ from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Callable
 
+from .programs import resolve_program
+
 CHANNEL_DIRNAME = ".agent-channel"
 REGISTRY_FILENAME = "agents.json"
 ROUNDS_DIRNAME = "rounds"
@@ -260,7 +262,7 @@ else
 fi
 
 "$PY" -I - "$MSG_FILE" "$ROOT" <<'PYEOF'
-import json, re, subprocess, sys
+import json, os, re, subprocess, sys
 
 # Distinguishable so the shell can name the ACTUAL reason. Sentinel objects
 # rather than strings: a registry whose contents happened to be `"absent"` would
@@ -269,6 +271,50 @@ ABSENT = object()
 CORRUPT = object()
 
 
+class GitUnavailable(Exception):
+    """No usable git outside the channel. Its own exit status, so the shell can
+    name it: the catch-all's 1 means "names no agent", which is not the fault."""
+
+
+def _git_executable(root):
+    """git by absolute path, never from the channel or the current directory.
+
+    git starts this hook in the channel's root, and Windows looked a bare `git`
+    up in the current directory before PATH (channel round 304). Inlined from
+    `graphite.programs.resolve_program`: `-I` cannot import graphite. Raises
+    rather than returning nothing, so the gate fails CLOSED -- an unreadable
+    registry must never read as an absent one, which is the bootstrap branch.
+    """
+    names = ("git.exe",) if os.name == "nt" else ("git",)
+    # The channel's whole subtree is refused; the cwd only itself, which is
+    # what Windows searches -- refusing everything beneath a cwd above git's
+    # install would refuse git.
+    channel = os.path.normcase(os.path.realpath(root))
+    cwd = os.path.normcase(os.path.realpath(os.getcwd()))
+
+    def refused(directory):
+        folded = os.path.normcase(directory)
+        return folded == cwd or folded == channel or folded.startswith(channel.rstrip(os.sep) + os.sep)
+
+    for raw in os.environ.get("PATH", "").split(os.pathsep):
+        if not raw or not os.path.isabs(raw):
+            continue
+        # The directory itself, as written and as resolved: a symlink inside
+        # the channel must not choose which outside git runs (1d8d8cf).
+        if refused(os.path.normpath(raw)) or refused(os.path.realpath(raw)):
+            continue
+        for name in names:
+            candidate = os.path.realpath(os.path.join(raw, name))
+            if not os.path.isfile(candidate):
+                continue
+            if os.name != "nt" and not os.access(candidate, os.X_OK):
+                continue
+            if refused(os.path.dirname(candidate)):
+                continue
+            return candidate
+    raise GitUnavailable("git was not found on PATH outside the channel")
+
+
 def _registry_at(root, spec):
     """Parse `agents.json` at a git revision spec.
 
@@ -282,7 +328,7 @@ def _registry_at(root, spec):
     is what the next commit will inherit as authority.
     """
     result = subprocess.run(
-        ["git", "-C", root, "show", spec],
+        [_git_executable(root), "-C", root, "show", spec],
         capture_output=True,
         text=True,
         # Explicit, for the reason `_git` documents: `text=True` alone decodes
@@ -346,6 +392,8 @@ try:
         # Parses, authorises nobody, and is not the empty object a fresh channel
         # seeds. Nothing legitimate produces this, and the gate must not guess.
         sys.exit(3)
+except GitUnavailable:
+    sys.exit(4)
 except Exception:
     # `SystemExit` derives from BaseException, so the exits above pass through
     # this handler untouched -- their codes survive.
@@ -405,6 +453,18 @@ EOF
     exit 1
 fi
 
+if [ "$STATUS" -eq 4 ]; then
+    # `echo`, not `cat`, for the reason the missing-interpreter branch gives: an
+    # environment that has lost git may have lost the rest of its toolchain.
+    echo "[agent-channel] BLOCKED: git was not found on PATH outside the channel." >&2
+    echo "" >&2
+    echo "The audit gate reads the registry from HEAD with git, and will not run a" >&2
+    echo "git that sits inside the channel or the current directory. It cannot" >&2
+    echo "verify this commit, so it is refused rather than waved through. This is" >&2
+    echo "NOT a problem with your commit message. Put git on PATH, then commit again." >&2
+    exit 1
+fi
+
 # The banner heredocs stay QUOTED. An earlier revision unquoted them to
 # interpolate `$PY`, which turned the audit gate's own output into a shell
 # expansion surface: any `$`, backtick or `$(...)` that later reaches this text
@@ -721,10 +781,18 @@ def _git(root: Path, *args: str, check: bool = True) -> str:
     refreshes stale stat data by REWRITING the index under `index.lock`, and a
     writer's `git add` that meets that lock fails. Only optional locks are
     skipped; `add` and `commit` still take the ones they need.
+
+    git is launched by ABSOLUTE path, from outside both the channel and the
+    directory this process stands in (channel round 304). The broker's current
+    directory is the agent's repository, and Windows looked a bare `git` up
+    there before PATH. See `graphite.programs`.
     """
+    git = resolve_program("git", exclude=(root,))
+    if git is None:
+        raise ChannelError("git_unavailable", "git was not found on PATH outside the repository")
     try:
         result = subprocess.run(  # noqa: S603
-            ["git", "-C", str(root), *args],  # noqa: S607
+            [str(git), "-C", str(root), *args],
             capture_output=True,
             text=True,
             encoding="utf-8",
@@ -766,8 +834,9 @@ def _commit(root: Path, paths: list[str], subject: str, agent: str) -> str:
     return _git(root, "rev-parse", "--short", "HEAD").strip()
 
 
-def _uncommitted_residue(root: Path) -> list[str]:
-    """Channel files an abandoned holder left behind uncommitted.
+def _uncommitted_residue(root: Path) -> list[str] | None:
+    """Channel files an abandoned holder left behind uncommitted, or None when
+    the scan itself failed.
 
     Automatic recovery makes this MORE important, not less. `status_events`
     reads from DISK, so an orphaned `status/NNN/*.json` written by a holder that
@@ -776,7 +845,10 @@ def _uncommitted_residue(root: Path) -> list[str]:
     look; once the lock clears itself, nobody is looking unless we say so.
 
     Best-effort by construction: this runs while we hold nothing, and a failure
-    to scan must never block a recovery that is otherwise safe.
+    to scan must never block a recovery that is otherwise safe. But it must not
+    read as a clean scan either (aramid llm-review 9751aab): `[]` says "the dead
+    holder left nothing", `None` says "we could not look". A wedged git -- the
+    likeliest cause of an abandoned lock -- is also what makes this fail.
     """
     try:
         # `--untracked-files=all`: bare `--porcelain` collapses a wholly
@@ -784,7 +856,7 @@ def _uncommitted_residue(root: Path) -> list[str]:
         # operator needs in order to go and look at it.
         porcelain = _git(root, "status", "--porcelain", "--untracked-files=all", check=False)
     except ChannelError:
-        return []
+        return None
     residue = set()
     for line in porcelain.splitlines():
         path = line[3:].strip().strip('"')
@@ -893,9 +965,12 @@ class _Lock:
         started = (first or {}).get("started_at")
         if isinstance(started, (int, float)) and not isinstance(started, bool):
             held_for = round(self._clock() - float(started), 1)
+        # No `host`: it is in the record for the operator reading the lock file,
+        # but nothing here decides on it -- identity is (pid, started_at) and
+        # staleness is the clock -- so it does not go to every caller (aramid
+        # llm-review 9a23b84).
         self.recovered = {
             "pid": (first or {}).get("pid"),
-            "host": (first or {}).get("host"),
             "held_seconds": held_for,
             "residue": _uncommitted_residue(self.root),
         }
@@ -1194,13 +1269,23 @@ def record_status(
 # --- inbox: notification and handover ---------------------------------------
 
 
-def inbox(root: Path, project_root: Path) -> list[Round]:
+def inbox(
+    root: Path,
+    project_root: Path,
+    *,
+    on_recovered: Callable[[dict], None] | None = None,
+) -> list[Round]:
     """Hand over rounds addressed to the caller that it has not been given yet.
 
     The `delivered` event is written HERE, by the broker, as the message goes
     out. The agent cannot assert it and cannot decline it, so an agent that
     ignores its inbox leaves a visible `delivered` with no follow-up rather than
     an absence indistinguishable from never having been told.
+
+    `on_recovered` receives each abandoned lock a delivery had to break. Every
+    other writer returns that to its caller; this one returns rounds, and used
+    to drop it -- on the busiest path, since every agent calls this at session
+    start (aramid llm-review 1810f9e).
     """
     root = require_channel(root)
     agent = derive_identity(root, project_root)
@@ -1217,7 +1302,9 @@ def inbox(root: Path, project_root: Path) -> list[Round]:
             pending.append((entry.number, entry))
 
     for number, _entry in pending:
-        _write_status_event(root, number, "delivered", agent, broker=True)
+        event = _write_status_event(root, number, "delivered", agent, broker=True)
+        if on_recovered is not None and "lock_recovered" in event:
+            on_recovered(event["lock_recovered"])
     return [entry for _number, entry in pending]
 
 

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/daemon_health.py

@@ -12,6 +12,7 @@ from pathlib import Path
 from typing import Any, Callable, TypeGuard
 
 from .daemon import DaemonStatusInvalidError, DaemonStatusTooLargeError, read_daemon_status
+from .programs import system_program
 from .routing.lifecycle import LifecycleReasonCode, ProviderLifecycleState
 from .windows_task import DEFAULT_TASK_NAME
 from .windows_startup import startup_status
@@ -285,7 +286,9 @@ def check_daemon_process(base: Path) -> dict[str, Any]:
     )
     try:
         result = subprocess.run(
-            ["powershell.exe", "-NoProfile", "-Command", ps],
+            # By absolute path: a bare `powershell.exe` is looked up in the
+            # current directory before System32 (channel round 304).
+            [str(system_program("WindowsPowerShell", "v1.0", "powershell.exe")), "-NoProfile", "-Command", ps],
             capture_output=True,
             text=True,
             # `errors` but deliberately NO `encoding`: Windows PowerShell 5.1

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/doctor.py

@@ -5,7 +5,6 @@ import importlib.util
 import json
 import math
 import os
-import shutil
 import subprocess
 import sys
 import threading
@@ -25,6 +24,7 @@ from .hookinstall import DEFAULT_HOOKS_DIRNAME, hook_shim_present, hooks_dir
 from .init import gitignored_managed_paths, managed_doc_paths
 from .hookshim import TRIGGERS
 from .llm import canonical_provider_name
+from .programs import resolve_program
 from .validation import validate_graph_bundle
 
 DoctorStatus = Literal["ready", "optional", "degraded", "blocked"]
@@ -469,7 +469,10 @@ def check_daemon(root: Path, daemon_base: Path) -> DoctorCheck:
 
 def check_mcp() -> DoctorCheck:
     package = importlib.util.find_spec("mcp") is not None
-    command = shutil.which("graphite-mcp") is not None
+    # Not `shutil.which`: on Windows it answers from the current directory
+    # first, so a `graphite-mcp.exe` sitting in the repo read as installed
+    # (channel round 304).
+    command = resolve_program("graphite-mcp", extensions=(".exe", ".cmd", ".bat", ".com")) is not None
     details = {"python_package": package, "command": command}
     if package and command:
         return DoctorCheck("mcp", "MCP", "ready", "MCP integration is available.", details)
@@ -498,26 +501,7 @@ def check_typescript(root: Path, *, timeout_seconds: float = 5.0) -> DoctorCheck
 
 
 def _resolve_node_executable(root: Path, *, platform_name: str | None = None) -> Path | None:
-    selected_platform = os.name if platform_name is None else platform_name
-    name = "node.exe" if selected_platform == "nt" else "node"
-    resolved_root = root.resolve()
-    for raw_directory in os.environ.get("PATH", "").split(os.pathsep):
-        directory = Path(raw_directory)
-        if not raw_directory or not directory.is_absolute():
-            continue
-        try:
-            candidate = (directory / name).resolve(strict=True)
-            if not candidate.is_file():
-                continue
-            if selected_platform != "nt" and not os.access(candidate, os.X_OK):
-                continue
-            try:
-                candidate.relative_to(resolved_root)
-            except ValueError:
-                return candidate
-        except OSError:
-            continue
-    return None
+    return resolve_program("node", exclude=(root,), platform_name=platform_name)
 
 
 def _node_environment() -> dict[str, str]:

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/doctor_probes.py

@@ -53,6 +53,14 @@ _LLM_CATEGORIES = frozenset(
 )
 _LLM_OUTPUT_LIMIT_BYTES = 4096
 _LLM_TIMEOUT_MAX_SECONDS = 60.0
+#: Added to the provider timeout to make the WORKER's process budget. The two
+#: used to be one number, so the worker's interpreter start was spent from the
+#: provider's time, and a loaded machine read `timeout` for a provider that was
+#: merely misconfigured (2 s read `timeout` 7 in 10 under 36 CPU burners). The
+#: worker enforces the provider timeout itself and reports `timeout` when the
+#: provider is slow, so this only bounds a worker that never answers. Generous
+#: on purpose: it costs nothing unless the worker hangs.
+_LLM_WORKER_START_ALLOWANCE_SECONDS = 30.0
 _REQUIRED_MCP_TOOLS = frozenset(
     {"graphite_query", "graphite_summary", "graphite_community", "graphite_refresh"}
 )
@@ -2100,7 +2108,7 @@ def probe_llm(
             [str(python), "-I", "-S", "-B", str(worker)],
             cwd=python.parent,
             stdin=stdin,
-            timeout_seconds=timeout_seconds,
+            timeout_seconds=timeout_seconds + _LLM_WORKER_START_ALLOWANCE_SECONDS,
             max_output_bytes=_LLM_OUTPUT_LIMIT_BYTES,
             check=False,
         )

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/git.py

@@ -9,6 +9,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Sequence
 
+from .programs import resolve_program
+
 
 DEFAULT_GIT_STDOUT_MAX_BYTES = 16 * 1024 * 1024
 _MINIMUM_GIT_VERSION = (2, 38, 0)
@@ -376,35 +378,12 @@ def _close_stdout(process: subprocess.Popen[bytes]) -> bool:
 def _resolve_git_executable(
     resolved_project_root: Path, *, platform_name: str | None = None
 ) -> Path:
-    selected_platform = os.name if platform_name is None else platform_name
-    executable_name = "git.exe" if selected_platform == "nt" else "git"
-
-    for raw_directory in os.environ.get("PATH", "").split(os.pathsep):
-        if not raw_directory:
-            continue
-        directory = Path(raw_directory)
-        if not directory.is_absolute():
-            continue
-        candidate = directory / executable_name
-        try:
-            if not candidate.is_file():
-                continue
-            resolved_candidate = candidate.resolve(strict=True)
-            if not resolved_candidate.is_file():
-                continue
-            if selected_platform != "nt" and not os.access(resolved_candidate, os.X_OK):
-                continue
-            try:
-                resolved_candidate.relative_to(resolved_project_root)
-            except ValueError:
-                pass
-            else:
-                continue
-        except OSError:
-            continue
-        return resolved_candidate
-
-    raise GitUnavailableError("Git executable was not found")
+    resolved = resolve_program(
+        "git", exclude=(resolved_project_root,), platform_name=platform_name
+    )
+    if resolved is None:
+        raise GitUnavailableError("Git executable was not found")
+    return resolved
 
 
 def _isolated_environment() -> dict[str, str]:

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/hookinstall.py

@@ -26,6 +26,7 @@ from pathlib import Path
 
 from .config import default_projects_root
 from .hookshim import CHAINED_SUFFIX, MARKER_START, TRIGGERS, render_trigger_shim
+from .programs import require_program
 
 DEFAULT_HOOKS_DIRNAME = ".githooks"
 
@@ -40,8 +41,12 @@ def _git(root: Path, *args: str) -> subprocess.CompletedProcess[str]:
     # locale codec, and git echoes repository paths and branch names that are
     # not required to be Latin-1. A failure decodes on subprocess's reader
     # thread, so it yields `stdout is None` rather than raising.
+    #
+    # By absolute path, from outside the repo (channel round 304): `init` runs
+    # from the root of the repo being onboarded, and Windows looked a bare `git`
+    # up there before PATH. A missing git still raises FileNotFoundError.
     return subprocess.run(
-        ["git", "-C", str(root), *args],
+        [str(require_program("git", exclude=(root,))), "-C", str(root), *args],
         capture_output=True,
         text=True,
         encoding="utf-8",

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/init.py

@@ -19,6 +19,7 @@ from .git import GitError, GitRunner
 from . import hookinstall
 from .hookinstall import DEFAULT_HOOKS_DIRNAME
 from .io import atomic_write_text
+from .programs import require_program
 
 # Bump whenever GRAPHITE_DOC, SHARED_POINTER, or CURSOR_POINTER changes;
 # test_template_change_requires_doc_version_bump pins the pairing. Files
@@ -320,8 +321,10 @@ def _is_git_repo(root: Path) -> bool:
     """Ground truth, not a `.git`-exists heuristic: `--is-inside-work-tree`
     also answers correctly for a repo `root` nested inside a larger one,
     matching how `hookinstall`'s own `git -C root ...` calls resolve."""
+    # By absolute path, from outside the repo (channel round 304); see
+    # `hookinstall._git`.
     result = subprocess.run(
-        ["git", "-C", str(root), "rev-parse", "--is-inside-work-tree"],
+        [str(require_program("git", exclude=(root,))), "-C", str(root), "rev-parse", "--is-inside-work-tree"],
         capture_output=True, text=True,
         # See `channel._git`: `text=True` alone uses the locale codec, and a
         # decode failure returns None instead of raising -- which here would

{graphite_code-1.1.0 → graphite_code-1.1.1}/src/graphite/mcp_server.py

@@ -172,8 +172,10 @@ class GraphiteMCPServer:
     def channel_inbox_tool(self) -> dict[str, Any]:
         from .channel import inbox
 
-        return self._channel_call(
-            lambda root: {
+        def handover(root: Path) -> dict[str, Any]:
+            recovered: list[dict] = []
+            rounds = inbox(root, self.project_root, on_recovered=recovered.append)
+            result: dict[str, Any] = {
                 "ok": True,
                 "rounds": [
                     {
@@ -183,10 +185,16 @@ class GraphiteMCPServer:
                         "posted": entry.posted,
                         "body": entry.body,
                     }
-                    for entry in inbox(root, self.project_root)
+                    for entry in rounds
                 ],
             }
-        )
+            # Present only when a lock was broken, like `post` and `status`: a
+            # quiet key on every response is noise nobody reads.
+            if recovered:
+                result["lock_recovered"] = recovered
+            return result
+
+        return self._channel_call(handover)
 
     def channel_status_tool(
         self, *, number: int, status: str, reason: str | None = None