witan-code 0.18.0__tar.gz → 0.19.1__tar.gz

{witan_code-0.18.0 → witan_code-0.19.1}/CHANGELOG.md

@@ -6,6 +6,78 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/) (pre-1.0:
 a MINOR bump may include breaking changes).
 
+## [Unreleased]
+
+## [0.19.1] - 2026-09-18
+
+### Changed
+
+- **Require `witan-core>=0.37`.** This keeps fresh `witan-code` installs on the
+  current shared core release alongside `witan-council`.
+
+## [0.19.0] - 2026-09-16
+
+### Changed
+
+- **Every code-graph edge type is keyed on `(@src, @dst)`.** A repeated
+  `Calls`/`References`/`Imports` pair upserts instead of appending. Needs
+  omnigraph 0.11; code graphs are rebuilt by reindexing. The indexer's
+  `_dedupe` stays, because a duplicate pair inside one load now fails the whole
+  batch.
+
+- **`ClusterGraphMissing` and `IngestRefused` are logged at WARNING, not
+  reported to Sentry.** Both are now `witan_core.refusal.Refusal`s, so fastmcp
+  logs them at WARNING with no traceback and the client receives the message
+  unchanged. Both are still `RuntimeError`s. Requires witan-core 0.35.
+
+- **Indexing a target with no resolvable repo key is refused, not guessed.**
+  When no `origin` remote resolved, the indexer fell back to the target's
+  directory name and wrote a permanent store into the shared per-repo store
+  directory under it. That key is neither unique — two `/tmp/*/tests` layouts
+  collide on `tests`, one silently overwriting the other's index — nor
+  recognizable next to real repo graphs; 36 such stores accumulated on one
+  machine, named `out2`, `tmp`, `data`, `sf`. Indexing something with no remote
+  is nearly always accidental (a scratch checkout, a temp repro layout), so the
+  write path now raises `repo.RepoNotDetected` naming the two opt-ins.
+  `witan code index`/`reindex` gained `--repo <uri>` alongside the existing
+  `WITAN_REPO`. **Reads of a local store are unaffected**: `repo.detect()` keeps
+  the directory fallback by default, so local stores already created under a
+  bare name stay reachable. Reads against a cluster drop it (see Fixed). The
+  hook paths (`session-init`, the PostToolUse reindex) already
+  swallow indexing errors, so this degrades to a no-op there rather than
+  surfacing.
+
+- **`reindex --rebuild` resolves the repo key before it deletes anything, and
+  deletes the store that key names.** `--rebuild` runs ahead of the index, and
+  it used to resolve its own key with the directory-name fallback — so
+  `--rebuild --repo <uri>` on a remoteless checkout checked and deleted the
+  legacy bare-name graph rather than the one it was told to use. Worse, the
+  refusal above lived only inside `index_path`, which runs afterwards: with
+  `--yes` skipping the confirmation prompt, a run that was about to be refused
+  could still drop the shared bridge graph first. The key is now resolved once,
+  up front, by `indexer.resolve_repo_key` and passed into the rebuild.
+
+### Fixed
+
+- **Reads against a cluster no longer probe a graph named after the checkout's
+  directory.** In a checkout with no `origin` remote, `repo.detect()` falls back
+  to the directory name, and reads used that key against shared graphs too,
+  where no graph is keyed that way. Every prompt in a scratch directory sent
+  `code_store_views` for a graph like `code-scratchpad`, `code-tmp` or
+  `code-memory`, which made up most `ClusterGraphMissing` events in Sentry.
+  `store.detect_repo(cfg)` turns the fallback off when `cfg.is_cluster`. The
+  server's read path, the `inject-context` hook and `symbols` use it, and
+  `symbols` also turns it off whenever it dispatches to a deployment, which a
+  target with only `remote_url` does while keeping a local code store. Local
+  stores keep the fallback.
+
+- **Two concurrent `code_store_open` calls for one view no longer fail the
+  second.** `ensure_branch` listed branches and then ran `branch create`, so two
+  callers could both see the view missing, and the loser failed with `branch
+  '<view>' already exists`. A create that fails that way now counts as success,
+  once a fresh listing confirms the branch is there. Any other create failure
+  still raises.
+
 ## [0.18.0] - 2026-09-02
 
 ### Added

{witan_code-0.18.0 → witan_code-0.19.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: witan-code
-Version: 0.18.0
+Version: 0.19.1
 Summary: witan-code — tree-sitter code graph + cross-repo bridge (mounts under `witan code`)
 Project-URL: Homepage, https://github.com/mitodl/agent-kit/tree/main/mcp/servers/witan-code
 Project-URL: Repository, https://github.com/mitodl/agent-kit
@@ -10,7 +10,7 @@ License-Expression: BSD-3-Clause
 Keywords: agent,code-graph,coding-agent,mcp,static-analysis,tree-sitter
 Classifier: Programming Language :: Python :: 3
 Requires-Python: >=3.11
-Requires-Dist: agent-config-kit<1,>=0.4
+Requires-Dist: agent-config-kit<1,>=0.7
 Requires-Dist: cyclopts<5,>=4
 Requires-Dist: fastmcp<5,>=4
 Requires-Dist: joserfc<2,>=1.0
@@ -26,7 +26,7 @@ Requires-Dist: tree-sitter-sql<0.4,>=0.3
 Requires-Dist: tree-sitter-typescript<0.24,>=0.23
 Requires-Dist: tree-sitter-yaml<0.8,>=0.7
 Requires-Dist: tree-sitter<0.26,>=0.25
-Requires-Dist: witan-core[cli,observability,remote,sentry]<1,>=0.32
+Requires-Dist: witan-core[cli,observability,remote,sentry]<1,>=0.37
 Provides-Extra: tasks
 Requires-Dist: fastmcp-tasks<5,>=4; extra == 'tasks'
 Description-Content-Type: text/markdown

{witan_code-0.18.0 → witan_code-0.19.1}/docs/CLI_REFERENCE.md

@@ -38,12 +38,21 @@ unchanged since the last index are skipped.
 | Argument | Type | Default | Notes |
 |---|---|---|---|
 | `PATH` / `--path` | `Path` | `.` | Positional or `--path`; file or directory |
+| `--repo` | `str` | detected | Canonical repo URI to key the code graph on |
 
 Prints a summary line: `scanned/indexed/skipped/symbols/edges/bindings/errors`.
 
+**A repo key is required.** It comes from the `origin` remote, or from `--repo`
+/ `WITAN_REPO`. When none resolves, indexing is **refused** rather than filed
+under the target's directory name — that key is not unique (two `/tmp/*/tests`
+layouts collide on `tests`) and leaves a permanent store in the shared code
+directory alongside real per-repo graphs. Reads still fall back to the
+directory name, so stores created under one before this remain reachable.
+
 ```bash
 witan-code index                  # index the whole repo, cwd
 witan-code index app/models.py    # index a single file
+witan-code index /tmp/scratch --repo https://github.com/org/name   # no origin
 ```
 
 ## `reindex [PATH]`
@@ -54,6 +63,14 @@ re-parsed and re-inserted even if unchanged.
 | Argument | Type | Default | Notes |
 |---|---|---|---|
 | `PATH` / `--path` | `Path` | `.` | Positional or `--path` |
+| `--rebuild` | `bool` | `false` | Delete unreadable stores before indexing |
+| `--yes` | `bool` | `false` | Skip `--rebuild`'s confirmation prompt |
+| `--repo` | `str` | detected | Canonical repo URI to key the code graph on |
+
+Same repo-key requirement as `index` above. The key is resolved **before**
+`--rebuild` deletes anything, and the rebuild deletes the store that key names —
+so a run that would be refused deletes nothing, and `--rebuild --repo <uri>`
+cannot drop a different graph than the one it is about to write.
 
 ```bash
 witan-code reindex   # rebuild the whole repo's store

{witan_code-0.18.0 → witan_code-0.19.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "witan-code"
-version = "0.18.0"
+version = "0.19.1"
 description = "witan-code — tree-sitter code graph + cross-repo bridge (mounts under `witan code`)"
 readme = "README.md"
 license = "BSD-3-Clause"
@@ -10,7 +10,14 @@ classifiers = [
     "Programming Language :: Python :: 3",
 ]
 dependencies = [
-    "agent-config-kit>=0.4,<1",
+    # >=0.7: witan_code/setup.py passes `mcp_servers_by_platform` to
+    # `RegistrationBundle`, a field added in agent-config-kit 0.7.0. It is a
+    # dataclass, so an external install resolving 0.4–0.6 raises TypeError on
+    # the unexpected keyword the moment `witan-code setup` builds its bundle.
+    # Same blind spot as the witan-core floors below — the workspace resolves
+    # agent-config-kit by path — except there is NO `check-core-floor`
+    # equivalent for this dependency, so this line is the only guard.
+    "agent-config-kit>=0.7,<1",
     # `remote`: the ADR-0005 client stack (OIDC device grant + MCP-client
     # proxy) behind `witan-code login` and the read commands' remote mode.
     # Costs nothing extra in practice — fastmcp is already required here and
@@ -121,7 +128,21 @@ dependencies = [
     # branches were open. Both times the pyproject line auto-merged without a
     # conflict, since both sides named the same number. Re-check it by hand on
     # every rebase; a floor one release low here is silent.
-    "witan-core[cli,remote,observability,sentry]>=0.32,<1",
+    #
+    # ★ >=0.34 IS AN IMPORT FLOOR, the ordinary kind: `cli.py` imports
+    # `with_console_ctx` from `witan_core.elicit`, added in witan-core 0.34.0 in
+    # the same change as this caller. Caught by `just check-core-floor` on PR
+    # CI, which is exactly the case that check exists for.
+    #
+    # ★ >=0.35 IS AN IMPORT FLOOR too: `store.py` and `ingest.py` import
+    # `witan_core.refusal`, added in witan-core 0.35.0 in the same change.
+    #
+    # ★ >=0.37 KEEPS BOTH SERVERS ON THE CURRENT SHARED CORE RELEASE. It also
+    # preserves >=0.36's format floor: omnigraph 0.11 is the only binary that
+    # parses the keyed `code-schema.pg`, and it restores the null fields 0.11
+    # drops from query rows. An older witan-core imports fine and then fails
+    # on the first schema init.
+    "witan-core[cli,remote,observability,sentry]>=0.37,<1",
     "fastmcp>=4,<5",
     "cyclopts>=4,<5",
     # [targets.<name>] override models (config.py) — also transitively pulled
@@ -204,7 +225,7 @@ testpaths = ["tests"]
 packages = ["witan_code"]
 
 [tool.bumpversion]
-current_version = "0.18.0"
+current_version = "0.19.1"
 allow_dirty = true
 
 [[tool.bumpversion.files]]

{witan_code-0.18.0 → witan_code-0.19.1}/tests/test_branches.py

@@ -4,6 +4,8 @@ import asyncio
 import inspect
 import subprocess
 
+import pytest
+
 from witan_code import repo as repo_module
 
 from .conftest import SAMPLE, requires_stack
@@ -155,6 +157,74 @@ def test_feature_branch_indexes_to_own_branch(tmp_path, monkeypatch):
     assert not on_main, "main view must not see in-flight branch symbols"
 
 
+@requires_stack
+def test_a_view_opened_by_two_callers_at_once_is_not_an_error(tmp_path, monkeypatch):
+    """Two concurrent `code_store_open` calls for one view both list branches
+    before either creates it, so the second create fails with "already exists"
+    (Sentry WITAN-4). The view exists, which is what both callers asked for."""
+    from witan_code import config as cfg_module
+    from witan_code import indexer
+    from witan_code.graph import OmnigraphClient
+
+    monkeypatch.setenv("WITAN_REPO", REPO)
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    cfg = cfg_module.load()
+    base = _git_repo(tmp_path / "r")
+    (base / "svc.py").write_text(SAMPLE)
+    indexer.index_path(base, config=cfg)
+    store = str(cfg_module.store_path(REPO, cfg.code_dir))
+
+    winner = OmnigraphClient(store, cfg.queries_dir, branch="feature_race")
+    loser = OmnigraphClient(store, cfg.queries_dir, branch="feature_race")
+    stale = loser.list_branches()
+    winner.ensure_branch()
+
+    real_list = loser.list_branches
+    listings = []
+
+    def list_branches():
+        listings.append(None)
+        return stale if len(listings) == 1 else real_list()
+
+    monkeypatch.setattr(loser, "list_branches", list_branches)
+    loser.ensure_branch()
+    assert len(listings) == 2, "the loser should have tried to create, then re-listed"
+    assert "feature_race" in real_list()
+
+
+@requires_stack
+@pytest.mark.parametrize(
+    ("error", "listed"),
+    [
+        ("omnigraph branch failed (exit 1):\npermission denied", ["main"]),
+        # The message alone is not trusted: the branch has to actually be there.
+        (
+            "omnigraph branch failed (exit 1):\nbranch 'feature_race' already exists",
+            ["main"],
+        ),
+    ],
+)
+def test_a_create_failure_that_is_not_the_race_still_raises(
+    tmp_path, monkeypatch, error, listed
+):
+    from witan_code import config as cfg_module
+    from witan_code.graph import OmnigraphClient
+
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    client = OmnigraphClient(
+        str(tmp_path / "store"), cfg_module.load().queries_dir, branch="feature_race"
+    )
+    monkeypatch.setattr(client, "list_branches", lambda: listed)
+
+    def fail(*_args, **_kwargs):
+        raise RuntimeError(error)
+
+    monkeypatch.setattr(client, "_run", fail)
+    with pytest.raises(RuntimeError) as excinfo:
+        client.ensure_branch()
+    assert str(excinfo.value) == error
+
+
 @requires_stack
 def test_a_logged_in_writer_owns_the_views_it_indexes(
     tmp_path, monkeypatch, logged_in_actor
@@ -310,7 +380,7 @@ def test_cached_git_amortizes_repeated_calls_within_ttl(monkeypatch):
     monkeypatch.setattr(
         srv.repo_module,
         "detect",
-        lambda: calls.__setitem__("detect", calls["detect"] + 1) or "r",
+        lambda **_kw: calls.__setitem__("detect", calls["detect"] + 1) or "r",
     )
     monkeypatch.setattr(
         srv.repo_module,
@@ -330,7 +400,7 @@ def test_cached_git_refreshes_after_ttl(monkeypatch):
 
     srv._git_context.clear()
     values = iter(["a", "b"])
-    monkeypatch.setattr(srv.repo_module, "detect", lambda: next(values))
+    monkeypatch.setattr(srv.repo_module, "detect", lambda **_kw: next(values))
 
     assert srv._cached_detect() == "a"
     srv._git_context["detect"] = (
@@ -355,7 +425,7 @@ def test_git_context_survives_within_a_test(monkeypatch):
     from witan_code import server as srv
 
     srv._git_context.clear()
-    monkeypatch.setattr(srv.repo_module, "detect", lambda: LEAKED_REPO)
+    monkeypatch.setattr(srv.repo_module, "detect", lambda **_kw: LEAKED_REPO)
     assert srv._cached_detect() == LEAKED_REPO
     assert srv._git_context["detect"][1] == LEAKED_REPO
 

{witan_code-0.18.0 → witan_code-0.19.1}/tests/test_cli_dispatch.py

@@ -90,6 +90,38 @@ def test_symbols_resolves_the_repo_client_side(monkeypatch):
     assert srv.calls[0][1]["repo"] == "https://github.com/test/detected"
 
 
+@pytest.mark.parametrize(("remote", "fallback"), [(True, False), (False, True)])
+def test_symbols_never_sends_a_directory_name_to_a_deployment(
+    monkeypatch, remote, fallback
+):
+    """A target with only `remote_url` keeps a local code store, so the store
+    config alone would allow the fallback; the remote dispatch must not."""
+    monkeypatch.delenv("WITAN_CODE_SERVER", raising=False)
+    monkeypatch.delenv("WITAN_CODE_TRANSPORT", raising=False)
+    srv = _stub(code_repo_symbols=[])
+    monkeypatch.setattr(cli_module, "_srv", lambda: srv)
+    monkeypatch.setattr(cli_module, "_is_remote", lambda: remote)
+    seen = []
+
+    def _detect(*_a, dirname_fallback=True, **_kw):
+        seen.append(dirname_fallback)
+        return "scratchproj" if dirname_fallback else None
+
+    monkeypatch.setattr("witan_code.repo.detect", _detect)
+
+    cli_module.symbols()
+
+    # Last, not only: the local path loads config, whose target match detects too.
+    assert seen[-1] is fallback
+    assert srv.calls == (
+        []
+        if remote
+        else [
+            ("code_repo_symbols", {"repo": "scratchproj", "role": None, "scheme": None})
+        ]
+    )
+
+
 def test_stitch_dispatches_to_precise_edges(monkeypatch, capsys):
     srv = _stub(
         code_precise_edges=[
@@ -320,7 +352,7 @@ def test_rebuild_refuses_a_path_that_is_not_the_repo_root(
     monkeypatch.setattr(store_module, "discard_store", _boom)
 
     with pytest.raises(SystemExit):
-        cli_module._rebuild_stores(sub, yes=True)
+        cli_module._rebuild_stores(sub, yes=True, slug="https://github.com/test/cg")
 
     out = capsys.readouterr().out
     assert "not the repo root" in out
@@ -352,6 +384,6 @@ def test_rebuild_refuses_a_file_path_with_real_git(tmp_path, monkeypatch, capsys
     monkeypatch.setattr(store_module, "discard_store", _boom)
 
     with pytest.raises(SystemExit):
-        cli_module._rebuild_stores(target, yes=True)
+        cli_module._rebuild_stores(target, yes=True, slug="https://github.com/test/cg")
 
     assert "not the repo root" in capsys.readouterr().out

{witan_code-0.18.0 → witan_code-0.19.1}/tests/test_context.py

@@ -6,9 +6,13 @@ check, store-exists branching), not the underlying query.
 """
 
 import os
+import shutil
+import subprocess
 import time
 from pathlib import Path
 
+import pytest
+
 from witan_code import context
 
 
@@ -45,6 +49,32 @@ def test_inject_context_empty_without_repo(tmp_path, monkeypatch):
     assert context.inject_context() == ""
 
 
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+def test_inject_context_does_not_probe_a_dirname_graph_on_a_cluster(
+    tmp_path, monkeypatch
+):
+    """A checkout with no origin has no repo key when the store is a cluster.
+
+    Every prompt in a scratch directory used to probe ``code-scratchpad``,
+    which no provisioning ever declares (Sentry WITAN-G).
+    """
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    monkeypatch.setenv("WITAN_CODE_SERVER", "https://omnigraph.example")
+    checkout = tmp_path / "scratchpad"
+    checkout.mkdir()
+    subprocess.run(["git", "init", "-q", str(checkout)], check=True)
+    monkeypatch.chdir(checkout)
+    probed = []
+    monkeypatch.setattr(
+        context.store_module.StoreRef,
+        "exists",
+        lambda self, config=None: probed.append(self) or False,
+    )
+
+    assert context.inject_context() == ""
+    assert probed == []
+
+
 def test_inject_context_empty_when_no_store_and_no_lock(tmp_path, monkeypatch):
     monkeypatch.setenv("WITAN_REPO", "https://github.com/test/cg")
     monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))

witan_code-0.19.1/tests/test_index_requires_a_repo_key.py

@@ -0,0 +1,67 @@
+"""Indexing something with no resolvable repo key is refused, not guessed.
+
+The guess used to be the target's directory name, written as a permanent store
+into the SHARED per-repo store directory. That key is neither unique (two
+``/tmp/*/tests`` layouts collide on ``tests``, one silently overwriting the
+other) nor recognizable next to real repo graphs — 36 such stores accumulated on
+one machine, named ``out2``, ``tmp``, ``data``, ``sf``.
+
+No omnigraph binary needed: the refusal lands before the store is touched, which
+is the whole point.
+"""
+
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from witan_code import indexer
+from witan_code import repo as repo_module
+
+
+@pytest.fixture
+def scratch(tmp_path, monkeypatch) -> Path:
+    """A source tree with no repo key available from anywhere."""
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    src = tmp_path / "tests"
+    src.mkdir()
+    (src / "a.py").write_text("def a():\n    return 1\n")
+    return src
+
+
+def _code_dir(tmp_path: Path) -> list[Path]:
+    code = tmp_path / "code"
+    return sorted(code.iterdir()) if code.exists() else []
+
+
+def test_bare_directory_is_refused_and_creates_no_store(scratch, tmp_path):
+    with pytest.raises(repo_module.RepoNotDetected) as exc:
+        indexer.index_path(scratch)
+
+    assert "no git remote" in str(exc.value)
+    assert "WITAN_REPO" in str(exc.value)
+    assert _code_dir(tmp_path) == []
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+def test_git_checkout_without_a_remote_is_refused_too(scratch, tmp_path):
+    """The other vector: a real checkout whose ``origin`` was never added.
+    ``detect`` resolves a git root here, so the refusal has to come from the
+    absence of a *remote*, not the absence of git."""
+    subprocess.run(["git", "init", "-q", str(scratch)], check=True)
+
+    with pytest.raises(repo_module.RepoNotDetected):
+        indexer.index_path(scratch)
+
+    assert _code_dir(tmp_path) == []
+
+
+def test_a_file_under_a_bare_directory_is_refused(scratch, tmp_path):
+    """The PostToolUse reindex hook passes a single edited file, which is how
+    scratch layouts got indexed without anyone running `index` at all."""
+    with pytest.raises(repo_module.RepoNotDetected):
+        indexer.index_path(scratch / "a.py")
+
+    assert _code_dir(tmp_path) == []

{witan_code-0.18.0 → witan_code-0.19.1}/tests/test_ingest.py

@@ -345,6 +345,22 @@ def test_the_graph_listing_names_repos_not_ids(sample_repo):
     assert ingest.graphs() == [REPO]
 
 
+def test_store_refusals_are_warning_level_refusals():
+    """Refusing a caller is the tier working, so neither reaches Sentry as an
+    error. Both stay RuntimeErrors for the callers that catch them as one."""
+    import logging
+
+    from witan_core.refusal import Refusal
+
+    from witan_code import store as store_module
+
+    for cls in (ingest.IngestRefused, store_module.ClusterGraphMissing):
+        exc = cls("refused")
+        assert isinstance(exc, Refusal)
+        assert isinstance(exc, RuntimeError)
+        assert exc.log_level == logging.WARNING
+
+
 def test_a_graph_the_cluster_does_not_declare_fails_on_the_first_call(monkeypatch):
     """Not on the thousandth record. A client cannot create a cluster graph —
     provisioning declares them — so a run that continues writes nowhere."""

witan_code-0.19.1/tests/test_rebuild_honours_the_repo_key.py

@@ -0,0 +1,90 @@
+"""`reindex --rebuild` resolves its repo key the same way the index does.
+
+`--rebuild` DELETES stores before indexing, so which key it resolves is not a
+display detail. Two ways that went wrong when it resolved its own:
+
+1. It used the directory-name fallback, so `--rebuild --repo <uri>` on a
+   remoteless checkout checked and deleted the legacy bare-name graph instead of
+   the one it was told to use.
+2. The refusal for an unkeyable target lived only inside `index_path`, which
+   runs *after* the rebuild — so `--rebuild --yes` there could drop the shared
+   bridge graph and only then decline to index. A run that is going to be
+   refused must delete nothing.
+"""
+
+import subprocess
+from pathlib import Path
+
+import pytest
+
+from witan_code import cli as cli_module
+
+
+@pytest.fixture
+def remoteless_checkout(tmp_path, monkeypatch) -> Path:
+    """A real git checkout whose `origin` was never added."""
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    root = tmp_path / "scratchproj"
+    root.mkdir()
+    subprocess.run(["git", "init", "-q", str(root)], check=True)
+    return root
+
+
+@pytest.fixture
+def never_deletes(monkeypatch):
+    """Fail loudly if any store is discarded."""
+    from witan_code import store as store_module
+
+    def _boom(*_args, **_kwargs):
+        raise AssertionError("deleted a store on a run that must delete nothing")
+
+    monkeypatch.setattr(store_module, "discard_store", _boom)
+
+
+def test_rebuild_uses_the_explicit_repo_not_the_directory_name(
+    remoteless_checkout, monkeypatch
+):
+    from witan_code import store as store_module
+
+    asked: list[str] = []
+    monkeypatch.setattr(
+        store_module,
+        "store_for_repo",
+        lambda slug, _cfg: asked.append(slug) or _Missing(),
+    )
+    monkeypatch.setattr(store_module, "bridge_store", lambda _cfg: _Missing())
+
+    cli_module._rebuild_stores(
+        remoteless_checkout, yes=True, slug="https://github.com/test/cg"
+    )
+
+    # Not "scratchproj" — the directory name the old fallback would have used.
+    assert asked == ["https://github.com/test/cg"]
+
+
+def test_an_unkeyable_target_is_refused_before_anything_is_deleted(
+    remoteless_checkout, never_deletes, capsys
+):
+    """The ordering half. `--yes` skips the confirmation prompt, so nothing else
+    stands between the old code and a deleted bridge graph."""
+    with pytest.raises(SystemExit):
+        cli_module.reindex(remoteless_checkout, rebuild=True, yes=True)
+
+    assert "no git remote" in capsys.readouterr().err
+
+
+def test_the_refusal_names_both_opt_ins(remoteless_checkout, never_deletes, capsys):
+    with pytest.raises(SystemExit):
+        cli_module.reindex(remoteless_checkout, rebuild=True, yes=True)
+
+    err = capsys.readouterr().err
+    assert "--repo" in err
+    assert "WITAN_REPO" in err
+
+
+class _Missing:
+    """A store ref that does not exist, so nothing is a rebuild candidate."""
+
+    def exists(self, _cfg=None):
+        return False

{witan_code-0.18.0 → witan_code-0.19.1}/tests/test_repo.py

@@ -85,3 +85,68 @@ def test_detect_tolerates_multivalued_fetch(tmp_path, monkeypatch):
         check=True,
     )
     assert repo.detect(start=tmp_path) == "https://github.com/mitodl/ol-data-platform"
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+def test_detect_falls_back_to_dirname_for_reads(tmp_path, monkeypatch):
+    """A store already created under a bare directory name has to stay
+    reachable, so the read default keeps the fallback."""
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    checkout = tmp_path / "scratchproj"
+    checkout.mkdir()
+    subprocess.run(["git", "init", "-q", str(checkout)], check=True)
+
+    assert repo.detect(start=checkout) == "scratchproj"
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+@pytest.mark.parametrize(
+    ("env", "expected"),
+    [
+        ({}, "scratchproj"),
+        ({"WITAN_CODE_SERVER": "https://omnigraph.example"}, None),
+        ({"WITAN_CODE_TRANSPORT": "mcp"}, None),
+    ],
+)
+def test_detect_repo_only_falls_back_to_dirname_for_a_local_store(
+    tmp_path, monkeypatch, env, expected
+):
+    """No cluster graph is keyed by a directory name, so a cluster read gets
+    no repo rather than a probe of a graph that cannot exist."""
+    from witan_code import store
+
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    monkeypatch.setenv("WITAN_CODE_DIR", str(tmp_path / "code"))
+    for name, value in env.items():
+        monkeypatch.setenv(name, value)
+    checkout = tmp_path / "scratchproj"
+    checkout.mkdir()
+    subprocess.run(["git", "init", "-q", str(checkout)], check=True)
+    monkeypatch.chdir(checkout)
+
+    assert store.detect_repo() == expected
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+def test_detect_without_dirname_fallback_returns_none(tmp_path, monkeypatch):
+    monkeypatch.delenv("WITAN_REPO", raising=False)
+    checkout = tmp_path / "scratchproj"
+    checkout.mkdir()
+    subprocess.run(["git", "init", "-q", str(checkout)], check=True)
+
+    assert repo.detect(start=checkout, dirname_fallback=False) is None
+
+
+@pytest.mark.skipif(shutil.which("git") is None, reason="git not on PATH")
+def test_dirname_fallback_does_not_override_an_explicit_repo(tmp_path, monkeypatch):
+    """The opt-in has to work on the write path: WITAN_REPO is resolved before
+    the remote lookup, so `dirname_fallback=False` never reaches it."""
+    monkeypatch.setenv("WITAN_REPO", "https://github.com/test/cg")
+    checkout = tmp_path / "scratchproj"
+    checkout.mkdir()
+    subprocess.run(["git", "init", "-q", str(checkout)], check=True)
+
+    assert (
+        repo.detect(start=checkout, dirname_fallback=False)
+        == "https://github.com/test/cg"
+    )