tensor-grep 1.76.0__tar.gz → 1.76.2__tar.gz

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensor-grep
-Version: 1.76.0
+Version: 1.76.2
 Requires-Dist: typer>=0.12,<0.26
 Requires-Dist: rich>=13.0
 Requires-Dist: mcp>=1.2.0

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/pyproject.toml

@@ -528,12 +528,14 @@ version_variables = [
 
 
 
+
+
 
 
 
 [project]
 name = "tensor-grep"
-version = "1.76.0"
+version = "1.76.2"
 description = "High-performance grep-compatible CLI with Rust, GPU, and AST/NLP routing"
 readme = { file = "rust_core/README.md", content-type = "text/markdown" }
 requires-python = ">=3.11"

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/rust_core/Cargo.lock

@@ -1579,7 +1579,7 @@ dependencies = [
 
 [[package]]
 name = "tensor_grep_rs"
-version = "1.76.0"
+version = "1.76.2"
 dependencies = [
  "aho-corasick",
  "anyhow",

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/rust_core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "tensor_grep_rs"
-version = "1.76.0"
+version = "1.76.2"
 edition = "2021"
 description = "Rust core engine for tensor-grep"
 license = "Apache-2.0"
@@ -436,6 +436,8 @@ path = "src/bin/tg_search_fast.rs"
 
 
 
+
+
 
 
 

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/rust_core/src/main.rs

@@ -5049,6 +5049,122 @@ mod tests {
                 .is_empty()
         );
     }
+
+    /// Creates a symlink at `link` pointing to `target`, dispatching to the platform-specific
+    /// primitive (mirrors write_bytes_refuse_symlink's own unix/windows/other split). Tests
+    /// call this and skip gracefully (matching the existing audit-manifest symlink tests) when
+    /// the sandbox lacks symlink privilege instead of failing the whole suite.
+    fn try_symlink_file(target: &Path, link: &Path) -> std::io::Result<()> {
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink(target, link)
+        }
+        #[cfg(windows)]
+        {
+            std::os::windows::fs::symlink_file(target, link)
+        }
+        #[cfg(not(any(unix, windows)))]
+        {
+            let _ = (target, link);
+            Err(std::io::Error::new(
+                std::io::ErrorKind::Unsupported,
+                "symlinks not supported on this platform",
+            ))
+        }
+    }
+
+    #[test]
+    fn test_create_checkpoint_refuses_symlink_at_index_path() {
+        // #115 Gap 2: checkpoint_index_path (checkpoint_storage_dir(root).join("index.json"))
+        // is a SHARED, PREDICTABLE path across every checkpoint under a given root -- unlike
+        // metadata.json (namespaced under a random checkpoint_id, unpredictable ahead of the
+        // call), an attacker who can write into the checkpoint root can plant a symlink at
+        // index.json in advance of any create_checkpoint call. Confirm create_checkpoint
+        // refuses to follow it instead of silently overwriting whatever the symlink targets.
+        let dir = tempfile::tempdir().unwrap();
+        let file_path = dir.path().join("fixture.py");
+        std::fs::write(&file_path, "def add(x, y): return x + y\n").unwrap();
+
+        let outside_dir = tempfile::tempdir().unwrap();
+        let outside_target = outside_dir.path().join("outside-target.json");
+        // Valid (empty-array) JSON so the pre-write "does index.json already exist -> read
+        // + parse it" branch succeeds and execution actually reaches the write call this
+        // test targets, instead of failing earlier on a JSON-parse error.
+        std::fs::write(&outside_target, b"[]").unwrap();
+
+        // Reuse the production scope-detection so the storage dir we plant the symlink under
+        // is byte-identical to the one create_checkpoint computes internally (both must agree
+        // post-canonicalization, or the symlink would land at the wrong path).
+        let path_str = file_path.to_str().unwrap();
+        let scope = detect_checkpoint_scope(path_str);
+        let storage_dir = checkpoint_storage_dir(&scope.root);
+        std::fs::create_dir_all(&storage_dir).unwrap();
+        let index_path = storage_dir.join("index.json");
+        if let Err(err) = try_symlink_file(&outside_target, &index_path) {
+            eprintln!(
+                "skipping test_create_checkpoint_refuses_symlink_at_index_path: cannot create a symlink in this environment: {err}"
+            );
+            return;
+        }
+
+        let result = create_checkpoint(path_str);
+        assert!(
+            result.is_err(),
+            "create_checkpoint must refuse to write the shared index through a symlink"
+        );
+        assert_eq!(
+            std::fs::read(&outside_target).unwrap(),
+            b"[]",
+            "the symlink's target outside the checkpoint root must be left untouched"
+        );
+    }
+
+    #[test]
+    fn test_restore_validation_rollback_snapshots_refuses_symlink_at_file_path() {
+        // #115 Gap 3: between "apply the edit" and a failed-validation rollback, an edited
+        // file could be swapped for a symlink pointing outside the project (e.g. via a
+        // hostile --lint-cmd/--test-cmd running between apply and rollback).
+        // restore_validation_rollback_snapshots must refuse to follow it instead of writing
+        // the pre-edit snapshot bytes through the symlink.
+        let dir = tempfile::tempdir().unwrap();
+        let file_path = dir.path().join("fixture.py");
+        let original_bytes = b"def add(x, y): return x + y\n".to_vec();
+        std::fs::write(&file_path, &original_bytes).unwrap();
+
+        let outside_dir = tempfile::tempdir().unwrap();
+        let outside_target = outside_dir.path().join("outside-target.py");
+        std::fs::write(&outside_target, b"UNTOUCHED").unwrap();
+
+        let mut snapshots = BTreeMap::new();
+        snapshots.insert(file_path.to_string_lossy().to_string(), original_bytes);
+
+        // Simulate the swap: the tracked file is replaced by a symlink after the pre-apply
+        // snapshot was captured.
+        std::fs::remove_file(&file_path).unwrap();
+        if let Err(err) = try_symlink_file(&outside_target, &file_path) {
+            eprintln!(
+                "skipping test_restore_validation_rollback_snapshots_refuses_symlink_at_file_path: cannot create a symlink in this environment: {err}"
+            );
+            return;
+        }
+
+        let summary = restore_validation_rollback_snapshots(&snapshots);
+
+        assert!(
+            !summary.success,
+            "restore must report failure when a snapshot target is a symlink"
+        );
+        assert!(
+            summary.files_restored.is_empty(),
+            "a refused symlink write must not be counted as restored"
+        );
+        assert_eq!(summary.errors.len(), 1);
+        assert_eq!(
+            std::fs::read(&outside_target).unwrap(),
+            b"UNTOUCHED",
+            "the symlink's target outside the rollback root must be left untouched"
+        );
+    }
 }
 
 fn run_command_cli(cli: CommandCli) -> anyhow::Result<()> {
@@ -8324,7 +8440,7 @@ fn create_checkpoint(path: &str) -> anyhow::Result<CheckpointCreateSummary> {
         std::fs::create_dir_all(parent)
             .with_context(|| format!("failed to create {}", parent.display()))?;
     }
-    std::fs::write(&metadata_path, serde_json::to_vec_pretty(&metadata)?)
+    write_bytes_refuse_symlink(&metadata_path, &serde_json::to_vec_pretty(&metadata)?)
         .with_context(|| format!("failed to write {}", metadata_path.display()))?;
 
     let index_path = checkpoint_index_path(&root);
@@ -8352,7 +8468,7 @@ fn create_checkpoint(path: &str) -> anyhow::Result<CheckpointCreateSummary> {
         std::fs::create_dir_all(parent)
             .with_context(|| format!("failed to create {}", parent.display()))?;
     }
-    std::fs::write(&index_path, serde_json::to_vec_pretty(&records)?)
+    write_bytes_refuse_symlink(&index_path, &serde_json::to_vec_pretty(&records)?)
         .with_context(|| format!("failed to write {}", index_path.display()))?;
 
     Ok(summary)
@@ -8972,7 +9088,7 @@ fn restore_validation_rollback_snapshots(
     let mut errors = Vec::new();
 
     for (file, bytes) in snapshots {
-        match std::fs::write(file, bytes) {
+        match write_bytes_refuse_symlink(Path::new(file), bytes) {
             Ok(()) => files_restored.push(file.clone()),
             Err(error) => errors.push(format!("failed to restore {file}: {error}")),
         }
@@ -9007,6 +9123,11 @@ fn emit_rollback_status(summary: &ValidationRollbackSummary) {
 /// previously followed by a plain `std::fs::write` -- a confined write could escape its
 /// anchor. Mirrors the confine-then-open discipline `_write_json_refuse_symlink` already
 /// uses on the Python side (`src/tensor_grep/cli/main.py`).
+///
+/// audit #115: also guards `create_checkpoint`'s metadata.json + the shared/predictable
+/// index.json write, and `restore_validation_rollback_snapshots`'s per-file restore write --
+/// the same TOCTOU class, just with the checkpoint/rollback root standing in for
+/// `--audit-manifest`'s confined target.
 fn write_bytes_refuse_symlink(path: &Path, bytes: &[u8]) -> anyhow::Result<()> {
     use std::fs::OpenOptions;
 

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/src/tensor_grep/cli/checkpoint_store.py

@@ -853,33 +853,38 @@ def create_checkpoint(path: str = ".") -> CheckpointCreateResult:
             # follow_symlinks=False: store a symlink AS a link, never copy its (possibly
             # out-of-root) target content into the snapshot (audit HIGH — symlink disclosure).
             shutil.copy2(source, destination, follow_symlinks=False)
-    except Exception:
-        # audit H4: never leave a half-copied checkpoint dir behind on any abort, budget-
-        # related or not (e.g. disk fills mid-copy despite the pre-flight, or a file
-        # vanishes/grows mid-loop). Remove the WHOLE per-checkpoint dir (metadata.json has not
-        # been written yet at this point, but snapshot_dir's own parent must go too, not just
-        # the snapshot/ subdir) -- matches how _prune_checkpoint_records removes a checkpoint.
+
+        result = CheckpointCreateResult(
+            checkpoint_id=checkpoint_id,
+            mode=mode,
+            root=str(root),
+            created_at=created_at,
+            file_count=len(entries),
+            undo_argv=_undo_argv(scope, checkpoint_id),
+            undo_command=_display_command(_undo_argv(scope, checkpoint_id)),
+            skipped_nested_repos=skipped_nested_repos,
+        )
+        _write_checkpoint_metadata(
+            root,
+            result,
+            entries,
+            scope_kind=scope.scope_kind,
+            original_path=scope.original_path,
+        )
+    except BaseException:
+        # audit #125a: catch BaseException, not Exception -- KeyboardInterrupt/SystemExit
+        # subclass BaseException directly (not Exception), so a Ctrl+C here previously escaped
+        # this handler entirely and left an uncleaned checkpoint dir behind. The guarded region
+        # also now extends through the metadata write below (not just the copy loop above): a
+        # failure writing metadata.json after a fully successful copy must not orphan that
+        # directory either -- audit H4's original cleanup only covered the copy loop. Remove the
+        # WHOLE per-checkpoint dir (metadata.json may or may not have been written yet, but
+        # snapshot_dir's own parent must go too, not just the snapshot/ subdir) -- matches how
+        # _prune_checkpoint_records removes a checkpoint. Always re-raise: the interrupt or
+        # exception must still propagate to the caller, never be swallowed here.
         shutil.rmtree(snapshot_dir.parent, ignore_errors=True)
         raise
 
-    result = CheckpointCreateResult(
-        checkpoint_id=checkpoint_id,
-        mode=mode,
-        root=str(root),
-        created_at=created_at,
-        file_count=len(entries),
-        undo_argv=_undo_argv(scope, checkpoint_id),
-        undo_command=_display_command(_undo_argv(scope, checkpoint_id)),
-        skipped_nested_repos=skipped_nested_repos,
-    )
-    _write_checkpoint_metadata(
-        root,
-        result,
-        entries,
-        scope_kind=scope.scope_kind,
-        original_path=scope.original_path,
-    )
-
     # q10 RMW race: load->mutate->write must be atomic w.r.t. every other writer of this
     # index.json, cross-process and cross-thread, or a concurrent insert can be lost (see
     # _index_lock.index_lock docstring / AGENTS.md Backend Fail-Closed Contract). Retention

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/src/tensor_grep/cli/repo_map.py

@@ -6412,12 +6412,20 @@ def _python_module_matches_definition(
     repo_root: Path | str | None = None,
     *,
     level: int = 0,
-) -> bool:
-    return bool(
-        _python_module_match_details(
-            importer_path, module_name, definition_path, repo_root, level=level
-        )["matched"]
+) -> tuple[bool, list[str]]:
+    """Return `(matched, provenance)`.
+
+    Unlike the bool-only `_js_ts_module_matches_definition` / `_rust_module_matches_definition`
+    siblings, this also threads through `_python_module_match_details`'s `provenance` (notably
+    the "sys-path-insert" tag) -- #155 fix: that tag was computed but provably unreachable
+    (this was the only caller, and it discarded everything but the bool) before this change.
+    The sole caller, `_confirm_import_edges`, uses it to report the tag honestly on `tg
+    importers` reverse edges instead of silently collapsing it into a generic label.
+    """
+    details = _python_module_match_details(
+        importer_path, module_name, definition_path, repo_root, level=level
     )
+    return bool(details["matched"]), list(details["provenance"])
 
 
 def _group_symbols_by_file(symbols: list[dict[str, Any]]) -> dict[str, list[dict[str, Any]]]:
@@ -15463,6 +15471,7 @@ def _confirm_import_edges(
             # a confirmed edge for an import whose target we can't actually read (precision
             # matters more than recall past this point).
             continue
+        python_provenance: list[str] = []
         if language_id in ("javascript", "typescript"):
             matched = _js_ts_module_matches_definition(
                 candidate_importer, module, target_file, repo_root
@@ -15479,7 +15488,7 @@ def _confirm_import_edges(
             # `_python_module_candidates` resolve a relative import correctly instead of
             # falling back to a bare path-suffix match that ignores directory context.
             level = int(raw_entry.get("level", 0) or 0)
-            matched = _python_module_matches_definition(
+            matched, python_provenance = _python_module_matches_definition(
                 candidate_importer, module, target_file, repo_root, level=level
             )
         if not matched or line in seen_lines:
@@ -15496,6 +15505,16 @@ def _confirm_import_edges(
             "provenance": provenance,
             "resolution_confidence": _import_graph_resolution_confidence(provenance),
         }
+        if python_provenance == ["sys-path-insert"]:
+            # #155 fix: report the sys.path-hack tag honestly on the reverse edge too, mirroring
+            # the forward `tg imports` path (`_resolve_raw_import_entry`). A SEPARATE field, not
+            # an overwrite of `provenance` above -- that string drives
+            # `_import_graph_resolution_confidence`'s enum ("parser-backed"/"heuristic"/
+            # "regex-heuristic", pinned by test_import_span_targeting.py) and this edge is still
+            # exactly as parser-confirmed (exact AST-parsed, exact resolved-path match) as any
+            # other Python edge, just resolved via a sys.path-hacked root instead of a standard
+            # one.
+            edge["path_provenance"] = "sys-path-insert"
         if dynamic:
             # Payload-bloat fix (#93 SUB-1 follow-up, same rationale as
             # _resolve_raw_import_entry): preserve the dynamic markers on an edge that IS

{tensor_grep-1.76.0 → tensor_grep-1.76.2}/src/tensor_grep/cli/runtime_paths.py

@@ -84,6 +84,13 @@ def _read_project_version_fallback() -> str:
     return "0.0.0"
 
 
+# Safe to cache (unlike `_native_tg_version` below, whose docstring at `inspect_native_tg_binary`
+# warns against a path-keyed cache going stale across an `os.replace` swap): this function takes
+# no arguments and only reads pyproject.toml + installed package metadata, neither of which change
+# within a single process lifetime. Called on every daemon probe (`_probe_daemon` in
+# session_daemon.py) since the daemon became default-on for symbol commands, so an uncached
+# pyproject.toml read + importlib.metadata scan on every probe is wasted I/O.
+@lru_cache(maxsize=1)
 def _expected_tg_version() -> str:
     source_version = _read_project_version_fallback()
     try: