witan-code 0.17.0__tar.gz → 0.19.0__tar.gz

{witan_code-0.17.0 → witan_code-0.19.0}/CHANGELOG.md

@@ -6,6 +6,117 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/) (pre-1.0:
 a MINOR bump may include breaking changes).
 
+## [Unreleased]
+
+## [0.19.0] - 2026-09-16
+
+### Changed
+
+- **Every code-graph edge type is keyed on `(@src, @dst)`.** A repeated
+  `Calls`/`References`/`Imports` pair upserts instead of appending. Needs
+  omnigraph 0.11; code graphs are rebuilt by reindexing. The indexer's
+  `_dedupe` stays, because a duplicate pair inside one load now fails the whole
+  batch.
+
+- **`ClusterGraphMissing` and `IngestRefused` are logged at WARNING, not
+  reported to Sentry.** Both are now `witan_core.refusal.Refusal`s, so fastmcp
+  logs them at WARNING with no traceback and the client receives the message
+  unchanged. Both are still `RuntimeError`s. Requires witan-core 0.35.
+
+- **Indexing a target with no resolvable repo key is refused, not guessed.**
+  When no `origin` remote resolved, the indexer fell back to the target's
+  directory name and wrote a permanent store into the shared per-repo store
+  directory under it. That key is neither unique — two `/tmp/*/tests` layouts
+  collide on `tests`, one silently overwriting the other's index — nor
+  recognizable next to real repo graphs; 36 such stores accumulated on one
+  machine, named `out2`, `tmp`, `data`, `sf`. Indexing something with no remote
+  is nearly always accidental (a scratch checkout, a temp repro layout), so the
+  write path now raises `repo.RepoNotDetected` naming the two opt-ins.
+  `witan code index`/`reindex` gained `--repo <uri>` alongside the existing
+  `WITAN_REPO`. **Reads of a local store are unaffected**: `repo.detect()` keeps
+  the directory fallback by default, so local stores already created under a
+  bare name stay reachable. Reads against a cluster drop it (see Fixed). The
+  hook paths (`session-init`, the PostToolUse reindex) already
+  swallow indexing errors, so this degrades to a no-op there rather than
+  surfacing.
+
+- **`reindex --rebuild` resolves the repo key before it deletes anything, and
+  deletes the store that key names.** `--rebuild` runs ahead of the index, and
+  it used to resolve its own key with the directory-name fallback — so
+  `--rebuild --repo <uri>` on a remoteless checkout checked and deleted the
+  legacy bare-name graph rather than the one it was told to use. Worse, the
+  refusal above lived only inside `index_path`, which runs afterwards: with
+  `--yes` skipping the confirmation prompt, a run that was about to be refused
+  could still drop the shared bridge graph first. The key is now resolved once,
+  up front, by `indexer.resolve_repo_key` and passed into the rebuild.
+
+### Fixed
+
+- **Reads against a cluster no longer probe a graph named after the checkout's
+  directory.** In a checkout with no `origin` remote, `repo.detect()` falls back
+  to the directory name, and reads used that key against shared graphs too,
+  where no graph is keyed that way. Every prompt in a scratch directory sent
+  `code_store_views` for a graph like `code-scratchpad`, `code-tmp` or
+  `code-memory`, which made up most `ClusterGraphMissing` events in Sentry.
+  `store.detect_repo(cfg)` turns the fallback off when `cfg.is_cluster`. The
+  server's read path, the `inject-context` hook and `symbols` use it, and
+  `symbols` also turns it off whenever it dispatches to a deployment, which a
+  target with only `remote_url` does while keeping a local code store. Local
+  stores keep the fallback.
+
+- **Two concurrent `code_store_open` calls for one view no longer fail the
+  second.** `ensure_branch` listed branches and then ran `branch create`, so two
+  callers could both see the view missing, and the loser failed with `branch
+  '<view>' already exists`. A create that fails that way now counts as success,
+  once a fresh listing confirms the branch is there. Any other create failure
+  still raises.
+
+## [0.18.0] - 2026-09-02
+
+### Added
+
+- **`witan --target <name> code index` reaches this package.** witan-council's
+  launcher gained an app-level `--target`, and `witan code …` mounts this
+  package's cyclopts App but *not* its meta launcher, so the value is forwarded
+  into `witan_code.selected_target` and read by `_srv()`. Before this the flag
+  was bound but never routed: `cli._srv()` called `load_remote_config()` with no
+  argument, so `witan --target ci code repos` answered from the ambient target
+  while appearing to work. Standalone `witan-code --target <name> …` works too.
+
+- **`witan code index` prints the store it wrote to, unconditionally.** The one
+  command whose entire output is about where symbols went was silent about which
+  graph received them — and memory and code graphs are routed by separate
+  settings, so a target whose memory is deployed can still index onto the
+  laptop. Printed for local and shared alike: a line that appears only in the
+  bad case is one nobody has learned to look for. Carried on `IndexStats` rather
+  than recomputed by the printer, so a *failed* run reports the same
+  destination — the run where "which graph was this?" is actually open.
+
+### Fixed
+
+- **`witan-code doctor` could not say which graph was broken under
+  `code_transport = "mcp"`.** The identifying column took `os.path.basename` of
+  the store address, which is right for a local path and wrong for an
+  MCP-routed one — those end in the endpoint URL, so all of production's
+  per-repo cluster graphs rendered as the identical string `mcp)`. `StoreRef`
+  gained a `label` that answers "which graph is this row" for all three address
+  forms, and `code_store_health` returns it alongside the full `store`.
+
+- **A failed index did not always name its destination.** `IndexStats` was built
+  *after* `ensure_branch()` and the existing-hash read, both of which are remote
+  calls, so an unreachable endpoint or a rejected token raised before the stats
+  existed and the summary had nothing to print. Stats are now built straight
+  after the store resolves, and those two setup calls are wrapped so a failure
+  arrives as `IndexFailed` carrying the destination. `check_writable` is
+  deliberately left outside: it raises `SharedGraphWriteRefused`, a clean
+  self-explanatory refusal that callers assert on by type, not the unattributed
+  failure the phases exist to annotate.
+
+- **`code_transport` is parsed off a target block.** A target registered with
+  `--remote-url` now carries `code_transport = "mcp"`, so branches indexed from
+  a checkout land on the cluster where another session — and another developer —
+  can see them, instead of in a directory on one laptop.
+
 ## [0.17.0] - 2026-09-01
 
 ### Fixed

{witan_code-0.17.0 → witan_code-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: witan-code
-Version: 0.17.0
+Version: 0.19.0
 Summary: witan-code — tree-sitter code graph + cross-repo bridge (mounts under `witan code`)
 Project-URL: Homepage, https://github.com/mitodl/agent-kit/tree/main/mcp/servers/witan-code
 Project-URL: Repository, https://github.com/mitodl/agent-kit
@@ -10,7 +10,7 @@ License-Expression: BSD-3-Clause
 Keywords: agent,code-graph,coding-agent,mcp,static-analysis,tree-sitter
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.11
-Requires-Dist: agent-config-kit<1,>=0.4
+Requires-Dist: agent-config-kit<1,>=0.7
 Requires-Dist: cyclopts<5,>=4
 Requires-Dist: fastmcp<5,>=4
 Requires-Dist: joserfc<2,>=1.0
@@ -26,7 +26,7 @@ Requires-Dist: tree-sitter-sql<0.4,>=0.3
 Requires-Dist: tree-sitter-typescript<0.24,>=0.23
 Requires-Dist: tree-sitter-yaml<0.8,>=0.7
 Requires-Dist: tree-sitter<0.26,>=0.25
-Requires-Dist: witan-core[cli,observability,remote,sentry]<1,>=0.32
+Requires-Dist: witan-core[cli,observability,remote,sentry]<1,>=0.36
 Provides-Extra: tasks
 Requires-Dist: fastmcp-tasks<5,>=4; extra == 'tasks'
 Description-Content-Type: text/markdown

{witan_code-0.17.0 → witan_code-0.19.0}/docs/CLI_REFERENCE.md

@@ -38,12 +38,21 @@ unchanged since the last index are skipped.
 | Argument | Type | Default | Notes |
 |---|---|---|---|
 | `PATH` / `--path` | `Path` | `.` | Positional or `--path`; file or directory |
+| `--repo` | `str` | detected | Canonical repo URI to key the code graph on |
 
 Prints a summary line: `scanned/indexed/skipped/symbols/edges/bindings/errors`.
 
+**A repo key is required.** It comes from the `origin` remote, or from `--repo`
+/ `WITAN_REPO`. When none resolves, indexing is **refused** rather than filed
+under the target's directory name — that key is not unique (two `/tmp/*/tests`
+layouts collide on `tests`) and leaves a permanent store in the shared code
+directory alongside real per-repo graphs. Reads still fall back to the
+directory name, so stores created under one before this remain reachable.
+
 ```bash
 witan-code index                  # index the whole repo, cwd
 witan-code index app/models.py    # index a single file
+witan-code index /tmp/scratch --repo https://github.com/org/name   # no origin
 ```
 
 ## `reindex [PATH]`
@@ -54,6 +63,14 @@ re-parsed and re-inserted even if unchanged.
 | Argument | Type | Default | Notes |
 |---|---|---|---|
 | `PATH` / `--path` | `Path` | `.` | Positional or `--path` |
+| `--rebuild` | `bool` | `false` | Delete unreadable stores before indexing |
+| `--yes` | `bool` | `false` | Skip `--rebuild`'s confirmation prompt |
+| `--repo` | `str` | detected | Canonical repo URI to key the code graph on |
+
+Same repo-key requirement as `index` above. The key is resolved **before**
+`--rebuild` deletes anything, and the rebuild deletes the store that key names —
+so a run that would be refused deletes nothing, and `--rebuild --repo <uri>`
+cannot drop a different graph than the one it is about to write.
 
 ```bash
 witan-code reindex   # rebuild the whole repo's store

{witan_code-0.17.0 → witan_code-0.19.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "witan-code"
-version = "0.17.0"
+version = "0.19.0"
 description = "witan-code — tree-sitter code graph + cross-repo bridge (mounts under `witan code`)"
 readme = "README.md"
 license = "BSD-3-Clause"
@@ -10,7 +10,14 @@ classifiers = [
     "Programming Language :: Python :: 3",
 ]
 dependencies = [
-    "agent-config-kit>=0.4,<1",
+    # >=0.7: witan_code/setup.py passes `mcp_servers_by_platform` to
+    # `RegistrationBundle`, a field added in agent-config-kit 0.7.0. It is a
+    # dataclass, so an external install resolving 0.4–0.6 raises TypeError on
+    # the unexpected keyword the moment `witan-code setup` builds its bundle.
+    # Same blind spot as the witan-core floors below — the workspace resolves
+    # agent-config-kit by path — except there is NO `check-core-floor`
+    # equivalent for this dependency, so this line is the only guard.
+    "agent-config-kit>=0.7,<1",
     # `remote`: the ADR-0005 client stack (OIDC device grant + MCP-client
     # proxy) behind `witan-code login` and the read commands' remote mode.
     # Costs nothing extra in practice — fastmcp is already required here and
@@ -121,7 +128,21 @@ dependencies = [
     # branches were open. Both times the pyproject line auto-merged without a
     # conflict, since both sides named the same number. Re-check it by hand on
     # every rebase; a floor one release low here is silent.
-    "witan-core[cli,remote,observability,sentry]>=0.32,<1",
+    #
+    # ★ >=0.34 IS AN IMPORT FLOOR, the ordinary kind: `cli.py` imports
+    # `with_console_ctx` from `witan_core.elicit`, added in witan-core 0.34.0 in
+    # the same change as this caller. Caught by `just check-core-floor` on PR
+    # CI, which is exactly the case that check exists for.
+    #
+    # ★ >=0.35 IS AN IMPORT FLOOR too: `store.py` and `ingest.py` import
+    # `witan_core.refusal`, added in witan-core 0.35.0 in the same change.
+    #
+    # ★ >=0.36 IS A FORMAT FLOOR, and the silent kind: nothing new is imported,
+    # but 0.36.0 is the release that installs omnigraph 0.11, the only binary
+    # that parses the keyed `code-schema.pg`, and restores the null fields 0.11
+    # drops from query rows. An older witan-core imports fine and then fails
+    # on the first schema init.
+    "witan-core[cli,remote,observability,sentry]>=0.36,<1",
     "fastmcp>=4,<5",
     "cyclopts>=4,<5",
     # [targets.<name>] override models (config.py) — also transitively pulled
@@ -204,7 +225,7 @@ testpaths = ["tests"]
 packages = ["witan_code"]
 
 [tool.bumpversion]
-current_version = "0.17.0"
+current_version = "0.19.0"
 allow_dirty = true
 
 [[tool.bumpversion.files]]

{witan_code-0.17.0 → witan_code-0.19.0}/tests/test_branches.py

@@ -4,6 +4,8 @@ import asyncio
 import inspect
 import subprocess
 
+import pytest
+
 from witan_code import repo as repo_module
 
 from .conftest import SAMPLE, requires_stack
@@ -155,6 +157,74 @@ def test_feature_branch_indexes_to_own_branch(tmp_path, monkeypatch):
     assert not on_main, "main view must not see in-flight branch symbols"
 
 
+@requires_stack
+def test_a_view_opened_by_two_callers_at_once_is_not_an_error(tmp_path, monkeypatch):
+    """Two concurrent `code_store_open` calls for one view both list branches
+    before either creates it, so the second create fails with "already exists"
+    (Sentry WITAN-4). The view exists, which is what both callers asked for."""
+    from witan_code import config as cfg_module
+    from witan_code import indexer
+    from witan_code.graph import OmnigraphClient
+
+    monkeypatch.setenv("WITAN_REPO", REPO)
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    cfg = cfg_module.load()
+    base = _git_repo(tmp_path / "r")
+    (base / "svc.py").write_text(SAMPLE)
+    indexer.index_path(base, config=cfg)
+    store = str(cfg_module.store_path(REPO, cfg.code_dir))
+
+    winner = OmnigraphClient(store, cfg.queries_dir, branch="feature_race")
+    loser = OmnigraphClient(store, cfg.queries_dir, branch="feature_race")
+    stale = loser.list_branches()
+    winner.ensure_branch()
+
+    real_list = loser.list_branches
+    listings = []
+
+    def list_branches():
+        listings.append(None)
+        return stale if len(listings) == 1 else real_list()
+
+    monkeypatch.setattr(loser, "list_branches", list_branches)
+    loser.ensure_branch()
+    assert len(listings) == 2, "the loser should have tried to create, then re-listed"
+    assert "feature_race" in real_list()
+
+
+@requires_stack
+@pytest.mark.parametrize(
+    ("error", "listed"),
+    [
+        ("omnigraph branch failed (exit 1):\npermission denied", ["main"]),
+        # The message alone is not trusted: the branch has to actually be there.
+        (
+            "omnigraph branch failed (exit 1):\nbranch 'feature_race' already exists",
+            ["main"],
+        ),
+    ],
+)
+def test_a_create_failure_that_is_not_the_race_still_raises(
+    tmp_path, monkeypatch, error, listed
+):
+    from witan_code import config as cfg_module
+    from witan_code.graph import OmnigraphClient
+
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    client = OmnigraphClient(
+        str(tmp_path / "store"), cfg_module.load().queries_dir, branch="feature_race"
+    )
+    monkeypatch.setattr(client, "list_branches", lambda: listed)
+
+    def fail(*_args, **_kwargs):
+        raise RuntimeError(error)
+
+    monkeypatch.setattr(client, "_run", fail)
+    with pytest.raises(RuntimeError) as excinfo:
+        client.ensure_branch()
+    assert str(excinfo.value) == error
+
+
 @requires_stack
 def test_a_logged_in_writer_owns_the_views_it_indexes(
     tmp_path, monkeypatch, logged_in_actor
@@ -310,7 +380,7 @@ def test_cached_git_amortizes_repeated_calls_within_ttl(monkeypatch):
     monkeypatch.setattr(
         srv.repo_module,
         "detect",
-        lambda: calls.__setitem__("detect", calls["detect"] + 1) or "r",
+        lambda **_kw: calls.__setitem__("detect", calls["detect"] + 1) or "r",
     )
     monkeypatch.setattr(
         srv.repo_module,
@@ -330,7 +400,7 @@ def test_cached_git_refreshes_after_ttl(monkeypatch):
 
     srv._git_context.clear()
     values = iter(["a", "b"])
-    monkeypatch.setattr(srv.repo_module, "detect", lambda: next(values))
+    monkeypatch.setattr(srv.repo_module, "detect", lambda **_kw: next(values))
 
     assert srv._cached_detect() == "a"
     srv._git_context["detect"] = (
@@ -355,7 +425,7 @@ def test_git_context_survives_within_a_test(monkeypatch):
     from witan_code import server as srv
 
     srv._git_context.clear()
-    monkeypatch.setattr(srv.repo_module, "detect", lambda: LEAKED_REPO)
+    monkeypatch.setattr(srv.repo_module, "detect", lambda **_kw: LEAKED_REPO)
     assert srv._cached_detect() == LEAKED_REPO
     assert srv._git_context["detect"][1] == LEAKED_REPO
 

{witan_code-0.17.0 → witan_code-0.19.0}/tests/test_cli_dispatch.py

@@ -90,6 +90,38 @@ def test_symbols_resolves_the_repo_client_side(monkeypatch):
     assert srv.calls[0][1]["repo"] == "https://github.com/test/detected"
 
 
+@pytest.mark.parametrize(("remote", "fallback"), [(True, False), (False, True)])
+def test_symbols_never_sends_a_directory_name_to_a_deployment(
+    monkeypatch, remote, fallback
+):
+    """A target with only `remote_url` keeps a local code store, so the store
+    config alone would allow the fallback; the remote dispatch must not."""
+    monkeypatch.delenv("WITAN_CODE_SERVER", raising=False)
+    monkeypatch.delenv("WITAN_CODE_TRANSPORT", raising=False)
+    srv = _stub(code_repo_symbols=[])
+    monkeypatch.setattr(cli_module, "_srv", lambda: srv)
+    monkeypatch.setattr(cli_module, "_is_remote", lambda: remote)
+    seen = []
+
+    def _detect(*_a, dirname_fallback=True, **_kw):
+        seen.append(dirname_fallback)
+        return "scratchproj" if dirname_fallback else None
+
+    monkeypatch.setattr("witan_code.repo.detect", _detect)
+
+    cli_module.symbols()
+
+    # Last, not only: the local path loads config, whose target match detects too.
+    assert seen[-1] is fallback
+    assert srv.calls == (
+        []
+        if remote
+        else [
+            ("code_repo_symbols", {"repo": "scratchproj", "role": None, "scheme": None})
+        ]
+    )
+
+
 def test_stitch_dispatches_to_precise_edges(monkeypatch, capsys):
     srv = _stub(
         code_precise_edges=[
@@ -320,7 +352,7 @@ def test_rebuild_refuses_a_path_that_is_not_the_repo_root(
     monkeypatch.setattr(store_module, "discard_store", _boom)
 
     with pytest.raises(SystemExit):
-        cli_module._rebuild_stores(sub, yes=True)
+        cli_module._rebuild_stores(sub, yes=True, slug="https://github.com/test/cg")
 
     out = capsys.readouterr().out
     assert "not the repo root" in out
@@ -352,6 +384,6 @@ def test_rebuild_refuses_a_file_path_with_real_git(tmp_path, monkeypatch, capsys
     monkeypatch.setattr(store_module, "discard_store", _boom)
 
     with pytest.raises(SystemExit):
-        cli_module._rebuild_stores(target, yes=True)
+        cli_module._rebuild_stores(target, yes=True, slug="https://github.com/test/cg")
 
     assert "not the repo root" in capsys.readouterr().out

witan_code-0.19.0/tests/test_cli_selected_target.py

@@ -0,0 +1,86 @@
+"""``witan code …`` dispatches to the target witan's launcher bound.
+
+This package's App is mounted by witan's CLI but its meta launcher is not, so
+witan's launcher forwards the ``--target`` it bound into
+:mod:`witan_code.selected_target` (the same forwarding ``--output-format``
+already gets, for the same reason). What is asserted here is the other end of
+that wire: that the dispatch path actually consults it.
+
+Resolving the ambient target here instead is not a cosmetic gap. ``witan code
+index`` WRITES a code graph, so it would have written to whichever deployment
+the checkout happened to match while the flag on the command line said
+otherwise — and said nothing about it.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from witan_code import cli as code_cli
+from witan_code import config as code_cfg
+from witan_code.selected_target import selected_target, set_selected_target
+
+
+@pytest.fixture(autouse=True)
+def _clean_selection():
+    """Module-level state, so a leaked value would silently steer a later test."""
+    set_selected_target(None)
+    yield
+    set_selected_target(None)
+
+
+def test_dispatch_reads_the_forwarded_target(monkeypatch):
+    seen = {}
+
+    def _record(target=None):
+        seen["target"] = target
+        return None  # in-process branch; a stub RemoteConfig is not the point
+
+    monkeypatch.setattr(code_cli, "_server", None)
+    monkeypatch.setattr(code_cfg, "load_remote_config", _record)
+    set_selected_target("qa")
+
+    code_cli._srv()
+
+    assert seen["target"] == "qa"
+
+
+def test_no_forwarded_target_leaves_resolution_where_it_was(monkeypatch):
+    """``None`` is not "no target": the standalone ``witan-code`` launcher
+    declares no ``--target``, and resolution falls through to ``WITAN_TARGET``
+    and the checkout's ``match_*`` rules exactly as it always did."""
+    seen = {}
+
+    def _record(target=None):
+        seen["target"] = target
+        return None
+
+    monkeypatch.setattr(code_cli, "_server", None)
+    monkeypatch.setattr(code_cfg, "load_remote_config", _record)
+
+    code_cli._srv()
+
+    assert seen["target"] is None
+
+
+def test_the_auth_path_reads_it_too(monkeypatch):
+    """``witan code login`` has to reach the same deployment the read commands
+    do, or it mints a token against one target and spends it on another."""
+    seen = {}
+
+    def _record(target=None):
+        seen["target"] = target
+        return None
+
+    monkeypatch.setattr(code_cfg, "load_remote_config", _record)
+    set_selected_target("ci")
+
+    with pytest.raises(SystemExit):
+        code_cli._remote_or_exit()  # no remote configured -> clean exit
+
+    assert seen["target"] == "ci"
+
+
+def test_accessor_round_trips():
+    set_selected_target("production")
+    assert selected_target() == "production"

{witan_code-0.17.0 → witan_code-0.19.0}/tests/test_config_targets.py

@@ -377,3 +377,78 @@ def test_unknown_index_role_is_rejected(monkeypatch, toml_file):
 
     with pytest.raises(ValueError, match="Unknown index_role"):
         load()
+
+
+# ── The seam with `witan target add` ─────────────────────────────────────────
+
+
+def test_the_block_witan_target_add_writes_routes_code_graphs_to_the_cluster(
+    monkeypatch, toml_file
+):
+    """The exact block `witan target add --remote-url …` emits, read back here.
+
+    These are two packages agreeing by convention, not by a shared type: witan
+    (witan-council) renders the TOML, witan-code parses it, and nothing fails
+    loudly if they drift. Before `target add` learned `--code-transport`, a
+    deployed target had no `code_transport` key at all and fell through to the
+    `direct` default, leaving code graphs on the developer's own machine while
+    memory went to the deployment — silently, since a local store is a working
+    store. Keep this literal in step with `witan.cli.targets._FIELD_ORDER`.
+    """
+    monkeypatch.setenv(
+        "WITAN_CONFIG",
+        toml_file(
+            """
+            [targets.ol]
+            remote_url = "https://witan.ci.ol.mit.edu/mcp"
+            oidc_issuer = "https://sso-ci.ol.mit.edu/realms/ol-platform-engineering"
+            oidc_audience = "witan"
+            code_transport = "mcp"
+            match_orgs = ["mitodl"]
+            """
+        ),
+    )
+    monkeypatch.setenv("WITAN_REPO", "https://github.com/mitodl/agent-kit")
+    monkeypatch.delenv("WITAN_TARGET", raising=False)
+    monkeypatch.delenv("WITAN_CODE_TRANSPORT", raising=False)
+    monkeypatch.delenv("WITAN_CODE_SERVER", raising=False)
+
+    cfg = load()
+    assert cfg.target_name == "ol"
+    assert cfg.code_transport == "mcp"
+    # `mcp` alone makes it a cluster graph — code_server stays unset, because
+    # the deployment holds the address and resolves the actor from the JWT.
+    assert cfg.code_server is None
+    assert cfg.is_cluster
+
+
+def test_a_deployed_target_without_code_transport_still_falls_back_to_local(
+    monkeypatch, toml_file
+):
+    """The pre-fix shape, pinned so the regression is legible rather than silent.
+
+    This is what every target registered before 2026-09-01 looks like. It is
+    not an error and never was — which is the whole problem, and why the
+    onboarding doc now tells people to re-run `target add --force`.
+    """
+    monkeypatch.setenv(
+        "WITAN_CONFIG",
+        toml_file(
+            """
+            [targets.ol]
+            remote_url = "https://witan.ci.ol.mit.edu/mcp"
+            oidc_issuer = "https://sso-ci.ol.mit.edu/realms/ol-platform-engineering"
+            match_orgs = ["mitodl"]
+            """
+        ),
+    )
+    monkeypatch.setenv("WITAN_REPO", "https://github.com/mitodl/agent-kit")
+    monkeypatch.delenv("WITAN_TARGET", raising=False)
+    monkeypatch.delenv("WITAN_CODE_TRANSPORT", raising=False)
+    monkeypatch.delenv("WITAN_CODE_SERVER", raising=False)
+
+    cfg = load()
+    assert cfg.code_transport == "direct"
+    assert not cfg.is_cluster
+    # Memory is deployed while code graphs are not — the split this task fixed.
+    assert load_remote_config() is not None

{witan_code-0.17.0 → witan_code-0.19.0}/tests/test_context.py

@@ -6,9 +6,13 @@ check, store-exists branching), not the underlying query.
 """
 
 import os
+import shutil
+import subprocess
 import time
 from pathlib import Path
 
+import pytest
+
 from witan_code import context
 
 
@@ -45,6 +49,32 @@ def test_inject_context_empty_without_repo(tmp_path, monkeypatch):
     assert context.inject_context() == ""
 
 
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+def test_inject_context_does_not_probe_a_dirname_graph_on_a_cluster(
+    tmp_path, monkeypatch
+):
+    """A checkout with no origin has no repo key when the store is a cluster.
+
+    Every prompt in a scratch directory used to probe ``code-scratchpad``,
+    which no provisioning ever declares (Sentry WITAN-G).
+    """
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    monkeypatch.setenv("WITAN_CODE_SERVER", "https://omnigraph.example")
+    checkout = tmp_path / "scratchpad"
+    checkout.mkdir()
+    subprocess.run(["git", "init", "-q", str(checkout)], check=True)
+    monkeypatch.chdir(checkout)
+    probed = []
+    monkeypatch.setattr(
+        context.store_module.StoreRef,
+        "exists",
+        lambda self, config=None: probed.append(self) or False,
+    )
+
+    assert context.inject_context() == ""
+    assert probed == []
+
+
 def test_inject_context_empty_when_no_store_and_no_lock(tmp_path, monkeypatch):
     monkeypatch.setenv("WITAN_REPO", "https://github.com/test/cg")
     monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))