roam-code 12.12__tar.gz → 12.12.2__tar.gz

{roam_code-12.12/src/roam_code.egg-info → roam_code-12.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: roam-code
-Version: 12.12
+Version: 12.12.2
 Summary: Instant codebase comprehension for AI coding agents
 Author: CosmoHac
 License-Expression: MIT

{roam_code-12.12 → roam_code-12.12.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "roam-code"
-version = "12.12"
+version = "12.12.2"
 description = "Instant codebase comprehension for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -103,6 +103,18 @@ dev = [
 [tool.setuptools.packages.find]
 where = ["src"]
 
+[tool.setuptools.package-data]
+# v12.12.1 / 12.12.2 — without these, data files don't ship in the
+# wheel. Pre-12.12.1 PyPI installs silently loaded zero taint rules;
+# v12.12.1 fixed taint + extractors but still missed Jenkinsfile (no
+# extension) and the MCP server card. v12.12.2 bundles every file
+# under templates/ci/ (Jenkinsfile + the YAMLs) and ships the server
+# card alongside the package so ``roam mcp --card`` works post-install.
+"roam.security.taint_rules" = ["*.yaml", "*.yml"]
+"roam.languages.extractors" = ["*.yaml", "*.yml"]
+"roam.templates.ci" = ["*"]
+"roam" = ["mcp-server-card.json"]
+
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 addopts = "-q --tb=short"

{roam_code-12.12 → roam_code-12.12.2}/src/roam/commands/cmd_ask.py

@@ -16,9 +16,13 @@ import click
 from roam.ask.classifier import classify
 from roam.ask.recipes import RECIPES, Recipe, by_name
 from roam.ask.runner import extract_symbol, fill_followups, run_recipe
+from roam.output.confidence import DEFAULT_CONFIDENCE_THRESHOLD, is_low_confidence
 from roam.output.formatter import json_envelope, to_json
 
-_CONFIDENCE_THRESHOLD = 0.15
+# Single source of truth for the low-confidence threshold across
+# ranked-output commands. Imported from output.confidence so cmd_ask
+# and any future ranker stay in lockstep.
+_CONFIDENCE_THRESHOLD = DEFAULT_CONFIDENCE_THRESHOLD
 
 
 def _recipe_listing_payload(recipe: Recipe) -> dict:
@@ -236,7 +240,8 @@ def ask(ctx, query, list_recipes, explain, recipe_override):
 
     ranked = _rank_recipes(query_text, recipe_override)
 
-    if not ranked or ranked[0][1] < _CONFIDENCE_THRESHOLD:
+    top_score = ranked[0][1] if ranked else 0.0
+    if not ranked or is_low_confidence(top_score, _CONFIDENCE_THRESHOLD):
         # Low confidence — show top-3 and bail out.
         _emit_low_confidence(query_text, ranked, json_mode)
         return

{roam_code-12.12 → roam_code-12.12.2}/src/roam/competitor_site_data.py

@@ -1364,7 +1364,7 @@ MAP_METADATA: dict[str, dict[str, object]] = {
         "peer": True,
         "graph": "PageRank + Tarjan + Louvain + layers",
         "note": "Graph algorithms (PageRank, SCC, Louvain, Fiedler) on tree-sitter ASTs fused with git history in SQLite. 122 MCP tools, 155 CLI commands. 19 Python idiom detectors (v12.7+).",
-        "version_evaluated": "12.10.1",
+        "version_evaluated": "12.12.2",
         "repo_url": "https://github.com/Cranot/roam-code",
     },
     "CKB/CodeMCP": {

roam_code-12.12.2/src/roam/languages/extractors/kotlin.yaml

@@ -0,0 +1,113 @@
+# Kotlin Language Extractor
+# Extracts symbols, references, and inheritance from Kotlin source code.
+#
+# Tree-sitter query notes:
+# - 'class' is a reserved keyword in query syntax, can't be used as node type
+# - Use (class_declaration (type_identifier) @name) to match all classes/interfaces
+# - Kind resolution happens in query_engine by checking first child type
+
+language: kotlin
+extensions: [.kt, .kts]
+grammar_alias: kotlin
+description: Kotlin programming language extractor
+
+# -------------------------------------------------------------------------
+# Symbol Extraction
+# -------------------------------------------------------------------------
+
+symbols:
+  # All class declarations (classes, interfaces, data classes, enums, sealed)
+  # Kind is resolved in query_engine by checking first child type
+  - query: |
+      (class_declaration
+        (type_identifier) @name
+      ) @def
+    kind:
+      default: class
+      context:
+        class_body: class
+    def_capture: def
+    name_capture: name
+
+  # Object declarations (singleton)
+  - query: |
+      (object_declaration
+        (type_identifier) @name
+      ) @def
+    kind:
+      default: object
+      context:
+        class_body: object
+    def_capture: def
+    name_capture: name
+
+  # Functions (top-level and methods)
+  - query: |
+      (function_declaration
+        (simple_identifier) @name
+      ) @def
+    kind:
+      default: function
+      context:
+        class_body: method
+    def_capture: def
+    name_capture: name
+
+  # Properties with variable_declaration (val name: Type)
+  - query: |
+      (property_declaration
+        (variable_declaration
+          (simple_identifier) @name)
+      ) @def
+    kind:
+      default: property
+      context:
+        class_body: field
+    def_capture: def
+    name_capture: name
+
+  # Type aliases
+  - query: |
+      (type_alias
+        (type_identifier) @name
+      ) @def
+    kind: typealias
+    def_capture: def
+    name_capture: name
+
+# -------------------------------------------------------------------------
+# Inheritance Extraction
+# -------------------------------------------------------------------------
+
+inheritance:
+  extends:
+    # class Child : Parent(args) - constructor invocation style
+    - query: |
+        (class_declaration
+          (type_identifier) @child
+          (delegation_specifier
+            (constructor_invocation
+              (user_type
+                (type_identifier) @parent)))
+        ) @inherit
+      relationship: extends
+      child_capture: child
+      parent_capture: parent
+
+    # object Child : Parent - object inheritance
+    - query: |
+        (object_declaration
+          (type_identifier) @child
+          (delegation_specifier
+            (user_type
+              (type_identifier) @parent))
+        ) @inherit
+      relationship: extends
+      child_capture: child
+      parent_capture: parent
+
+# -------------------------------------------------------------------------
+# References (disabled for now)
+# -------------------------------------------------------------------------
+
+references: {}

roam_code-12.12.2/src/roam/mcp-server-card.json

@@ -0,0 +1,156 @@
+{
+  "$schema": "https://schemas.modelcontextprotocol.io/server-card/v1",
+  "name": "roam-code",
+  "display_name": "roam — instant codebase intelligence",
+  "version": "12.12.2",
+  "description": "Architectural sight for AI agents before they edit. Pre-indexes symbols, call graphs, dependencies, architecture layers, and git history into a local SQLite DB. 122 MCP tools, 10 resources, 5 prompts, 27 languages. 100% local, zero API keys.",
+  "vendor": {
+    "name": "Cranot",
+    "url": "https://github.com/Cranot"
+  },
+  "homepage": "https://cranot.github.io/roam-code/",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Cranot/roam-code"
+  },
+  "documentation": "https://cranot.github.io/roam-code/getting-started.html",
+  "license": "MIT",
+  "spdx_license_id": "MIT",
+  "categories": [
+    "code-intelligence",
+    "static-analysis",
+    "code-graph",
+    "ai-coding",
+    "supply-chain",
+    "security",
+    "attestation"
+  ],
+  "tags": [
+    "code-intelligence",
+    "tree-sitter",
+    "mcp-server",
+    "code-graph",
+    "graph-analysis",
+    "code-quality",
+    "openvex",
+    "in-toto",
+    "cosign",
+    "code-rag",
+    "agent-tools"
+  ],
+  "transport": {
+    "primary": "stdio",
+    "supported": ["stdio", "sse", "streamable-http"],
+    "default_command": ["roam", "mcp"]
+  },
+  "install": {
+    "pypi": "roam-code",
+    "command": "pip install \"roam-code[mcp]\"",
+    "min_python": "3.9",
+    "post_install": "roam init"
+  },
+  "capabilities": {
+    "tools": {
+      "total": 120,
+      "presets": {
+        "core": 33,
+        "review": 50,
+        "refactor": 60,
+        "debug": 55,
+        "architecture": 70,
+        "compliance": 14,
+        "full": 120
+      },
+      "tasks_api": {
+        "supported": true,
+        "spec_version": "2025-11-25",
+        "required_tools": [
+          "roam_init",
+          "roam_reindex",
+          "roam_health",
+          "roam_understand",
+          "roam_simulate"
+        ]
+      },
+      "sampling": true,
+      "completions": true,
+      "progress": true
+    },
+    "resources": {
+      "total": 10,
+      "watched": true
+    },
+    "prompts": {
+      "total": 5
+    }
+  },
+  "languages_supported": [
+    "python", "javascript", "typescript", "java", "go", "rust", "c",
+    "csharp", "php", "ruby", "kotlin", "swift", "scala", "sql", "foxpro",
+    "apex", "aura", "visualforce", "sfxml", "hcl", "yaml", "vue", "tsx",
+    "jsx", "html", "css", "objective-c"
+  ],
+  "compliance_artifacts": {
+    "in_toto_v1_predicate": "https://roam-code.dev/CodeGraph/v1",
+    "in_toto_v1_aibom_predicate": "https://roam-code.dev/CodeGraph-AIBOM/v1",
+    "openvex_compatible": true,
+    "openvex_disallowed_labels": ["code_not_reachable"],
+    "sbom_formats": ["cyclonedx-1.7", "spdx-2.3"],
+    "aibom_extension_version": "0.1",
+    "sigstore": {
+      "keyless_signing": true,
+      "offline_signing": true,
+      "verify_command": "roam cga verify <statement>"
+    }
+  },
+  "agent_first_features": {
+    "boolean_oracles": [
+      "roam_oracle_symbol_exists",
+      "roam_oracle_route_exists",
+      "roam_oracle_is_test_only",
+      "roam_oracle_is_reachable_from_entry",
+      "roam_oracle_is_clone_of"
+    ],
+    "compound_tools": [
+      "roam_explore",
+      "roam_prepare_change",
+      "roam_review_change",
+      "roam_diagnose_issue"
+    ],
+    "intent_classifier": "roam_ask",
+    "fleet_planner": "roam_fleet_plan",
+    "patch_verifier": "roam_critique",
+    "graph_aware_retrieval": "roam_retrieve",
+    "llm_augmented_taint": "roam_taint_classify"
+  },
+  "operational": {
+    "telemetry": "none",
+    "network_required": false,
+    "api_keys_required": false,
+    "container_required": false,
+    "average_index_time_seconds_per_kloc": 0.6,
+    "typical_db_size_per_kloc_kb": 80
+  },
+  "compatibility": {
+    "claude_code": "tested",
+    "claude_desktop": "tested",
+    "cursor": "tested",
+    "windsurf": "tested",
+    "vscode": "tested",
+    "gemini_cli": "tested",
+    "codex_cli": "tested",
+    "continue_dev": "via mcp-setup snippet"
+  },
+  "discovery": {
+    "registries": [
+      "pypi",
+      "github",
+      "modelcontextprotocol.io",
+      "pulsemcp.com",
+      "smithery.ai",
+      "mcp.so"
+    ],
+    "card_url": "https://cranot.github.io/roam-code/.well-known/mcp-server-card.json"
+  },
+  "schema_version": 1
+}

{roam_code-12.12 → roam_code-12.12.2}/src/roam/mcp_server.py

@@ -5873,31 +5873,35 @@ def mcp_cmd(transport, host, port, no_auto_index, list_tools, list_tools_json, c
 
     if card:
         # MCP Server Card per blog.modelcontextprotocol.io/posts/2026-mcp-roadmap.
-        # Loaded from the canonical static file so the CLI and the hosted
-        # docs site agree byte-for-byte. First-mover discovery for the
-        # MCP ecosystem registries (PulseMCP, mcp.so, Smithery, etc.).
+        # First-mover discovery for the MCP ecosystem registries
+        # (PulseMCP, mcp.so, Smithery, etc.). v12.12.2: the card is
+        # now bundled inside the installed package (src/roam/mcp-server-card.json)
+        # so post-PyPI ``roam mcp --card`` works without a source
+        # checkout. The docs/site/.well-known/ copy stays canonical for
+        # the hosted /well-known URL — they are kept in sync via the
+        # release process.
         from pathlib import Path as _Path
 
-        card_path = (
+        bundled = _Path(__file__).resolve().parent / "mcp-server-card.json"
+        if bundled.is_file():
+            click.echo(bundled.read_text(encoding="utf-8").rstrip())
+            return
+
+        # Source-checkout fallback so dev runs against an unbuilt tree
+        # still find the docs-site copy.
+        for candidate in (
             _Path(__file__).resolve().parents[1].parent.parent
             / "docs"
             / "site"
             / ".well-known"
-            / "mcp-server-card.json"
-        )
-        if not card_path.is_file():
-            # Fallback: walk up from the current module file two more levels.
-            card_path = (
-                _Path(__file__).resolve().parent.parent.parent
-                / "docs"
-                / "site"
-                / ".well-known"
-                / "mcp-server-card.json"
-            )
-        if not card_path.is_file():
-            click.echo("error: server card file not found", err=True)
-            raise SystemExit(1)
-        click.echo(card_path.read_text(encoding="utf-8").rstrip())
+            / "mcp-server-card.json",
+            _Path(__file__).resolve().parent.parent.parent / "docs" / "site" / ".well-known" / "mcp-server-card.json",
+        ):
+            if candidate.is_file():
+                click.echo(candidate.read_text(encoding="utf-8").rstrip())
+                return
+        click.echo("error: server card file not found", err=True)
+        raise SystemExit(1)
         return
 
     if mcp is None:

roam_code-12.12.2/src/roam/security/taint_rules/api_error_leak.yaml

@@ -0,0 +1,28 @@
+id: js-api-error-leak
+description: Raw backend error.message returned to the client leaks stack traces, ORM details, and SQL fragments (CWE-209 Information Exposure Through an Error Message). Use a sanitised error wrapper.
+severity: warning
+cwe: CWE-209
+languages:
+  - javascript
+  - typescript
+sources:
+  - error.message
+  - err.message
+  - exception.message
+  - error.stack
+  - err.stack
+  - error.detail
+sinks:
+  - res.send
+  - res.json
+  - res.write
+  - response.json
+  - response.send
+  - throw
+  - reply.send
+  - context.json
+sanitizers:
+  - sanitizeError
+  - publicError
+  - userFacingError
+  - toJSON

roam_code-12.12.2/src/roam/security/taint_rules/java_fileupload_path_traversal.yaml

@@ -0,0 +1,28 @@
+id: java-fileupload-path-traversal
+description: Multipart upload filename (FileItem / Part / FileUpload) into Files / FileOutputStream / Paths.get without basename or allowlist check. CodeQL 2.24 ships equivalent FileItem and javax/jakarta servlet Part models.
+severity: error
+cwe: CWE-22
+languages:
+  - java
+sources:
+  - getName
+  - getOriginalFilename
+  - getSubmittedFileName
+  - FileItem.getName
+  - Part.getSubmittedFileName
+sinks:
+  - Files.write
+  - Files.createFile
+  - Files.copy
+  - Files.move
+  - Files.newOutputStream
+  - Paths.get
+  - File
+  - FileOutputStream
+  - FileWriter
+sanitizers:
+  - Paths.normalize
+  - Path.normalize
+  - isUnderRoot
+  - sanitizeFilename
+  - FilenameUtils.getName

roam_code-12.12.2/src/roam/security/taint_rules/js_insecure_jwt_decode.yaml

@@ -0,0 +1,23 @@
+id: js-insecure-jwt-decode
+description: JWT decoded without signature verification (CWE-347). atob(token.split('.')[1]) reads the payload but does NOT validate the signature; use a verifying library (jsonwebtoken.verify, jose.jwtVerify) instead.
+severity: error
+cwe: CWE-347
+languages:
+  - javascript
+  - typescript
+sources:
+  - req.headers.authorization
+  - req.cookies
+  - localStorage.getItem
+  - sessionStorage.getItem
+  - document.cookie
+sinks:
+  - atob
+  - jwt_decode
+  - jwtDecode
+  - jwt-decode
+  - JSON.parse
+sanitizers:
+  - jsonwebtoken.verify
+  - jose.jwtVerify
+  - jwks-rsa

roam_code-12.12.2/src/roam/security/taint_rules/js_localstorage_secrets.yaml

@@ -0,0 +1,25 @@
+id: js-localstorage-secrets
+description: Sensitive data (tokens, credentials, JWTs) stored in localStorage where an XSS gives an attacker exfil. Prefer httpOnly cookies or sessionStorage with care (CWE-922 Insecure Storage of Sensitive Information).
+severity: warning
+cwe: CWE-922
+languages:
+  - javascript
+  - typescript
+sources:
+  - access_token
+  - refresh_token
+  - id_token
+  - jwt
+  - apiKey
+  - api_key
+  - password
+  - secret
+  - credentials
+  - sessionToken
+  - bearer
+sinks:
+  - localStorage.setItem
+  - sessionStorage.setItem
+sanitizers:
+  - obfuscate
+  - encryptForStorage

roam_code-12.12.2/src/roam/security/taint_rules/js_prototype_pollution.yaml

@@ -0,0 +1,30 @@
+id: js-prototype-pollution
+description: Untrusted input merged into existing objects (CWE-1321 Improperly Controlled Modification of Object Prototype Attributes).
+severity: error
+cwe: CWE-1321
+languages:
+  - javascript
+  - typescript
+sources:
+  - req.query
+  - req.body
+  - req.params
+  - location.search
+  - URLSearchParams
+  - JSON.parse
+sinks:
+  - Object.assign
+  - lodash.merge
+  - lodash.mergeWith
+  - lodash.set
+  - lodash.setWith
+  - _.merge
+  - _.mergeWith
+  - _.set
+  - _.setWith
+  - $.extend
+  - jQuery.extend
+sanitizers:
+  - sanitizeObject
+  - reject_proto_keys
+  - hasOwnProperty

roam_code-12.12.2/src/roam/security/taint_rules/js_ssrf.yaml

@@ -0,0 +1,21 @@
+id: js-ssrf
+description: Untrusted URL flowing into outbound HTTP request
+severity: warning
+cwe: CWE-918
+languages:
+  - javascript
+  - typescript
+sources:
+  - req.query
+  - req.body
+  - req.params
+sinks:
+  - fetch
+  - axios.get
+  - axios.post
+  - http.get
+  - https.get
+  - request.get
+sanitizers:
+  - validateUrl
+  - urlAllowList

roam_code-12.12.2/src/roam/security/taint_rules/js_xss.yaml

@@ -0,0 +1,23 @@
+id: js-xss
+description: Untrusted input flowing into the DOM without escaping
+severity: error
+cwe: CWE-79
+languages:
+  - javascript
+  - typescript
+sources:
+  - req.query
+  - req.body
+  - req.params
+  - location.search
+  - URLSearchParams
+sinks:
+  - innerHTML
+  - outerHTML
+  - document.write
+  - eval
+  - dangerouslySetInnerHTML
+sanitizers:
+  - DOMPurify.sanitize
+  - escape
+  - textContent

roam_code-12.12.2/src/roam/security/taint_rules/python_basic.yaml

@@ -0,0 +1,25 @@
+id: python-command-injection
+description: Untrusted user input flowing into shell-style command execution
+severity: error
+cwe: CWE-78
+languages:
+  - python
+sources:
+  - request.args
+  - request.form
+  - request.GET
+  - request.POST
+  - request.json
+  - input
+  - sys.stdin
+sinks:
+  - subprocess.run
+  - subprocess.call
+  - subprocess.Popen
+  - os.system
+  - os.popen
+  - eval
+  - exec
+sanitizers:
+  - shlex.quote
+  - shlex.split

roam_code-12.12.2/src/roam/security/taint_rules/python_deserialization.yaml

@@ -0,0 +1,34 @@
+id: python-deserialization
+description: Untrusted input deserialized through pickle/yaml/marshal, enabling RCE
+severity: error
+cwe: CWE-502
+languages:
+  - python
+sources:
+  - request.args
+  - request.form
+  - request.GET
+  - request.POST
+  - request.json
+  - request.body
+  - request.data
+  - request.cookies
+  - request.files
+  - input
+  - sys.stdin
+sinks:
+  - pickle.loads
+  - pickle.load
+  - cPickle.loads
+  - cPickle.load
+  - marshal.loads
+  - marshal.load
+  - yaml.load
+  - yaml.full_load
+  - yaml.unsafe_load
+  - shelve.open
+  - dill.loads
+  - dill.load
+sanitizers:
+  - yaml.safe_load
+  - json.loads

roam_code-12.12.2/src/roam/security/taint_rules/python_path_traversal.yaml

@@ -0,0 +1,22 @@
+id: python-path-traversal
+description: Untrusted input flowing into filesystem operations without sanitisation
+severity: error
+cwe: CWE-22
+languages:
+  - python
+sources:
+  - request.args
+  - request.form
+  - request.files
+  - input
+sinks:
+  - open
+  - os.path.join
+  - shutil.copy
+  - shutil.move
+  - pathlib.Path
+sanitizers:
+  - secure_filename
+  - werkzeug.utils.secure_filename
+  - os.path.normpath
+  - os.path.abspath