safishamsiandClaude Opus 4.8 f52b8dbc69 harden(bash): stop .. source paths escaping the corpus tree (#2596) ...

The #2690 form-3 (`$(dirname …)`) branch had no `..` guard and the tracked
form-4 branch let `..` walk past the base to an arbitrary host path, so a
hostile corpus could make the extractor stat and record an out-of-tree file
(source "$(dirname "$VAR")/../../../../etc/passwd") — a corpus-side info leak,
since resolve_bash_source_edges only filters *resolved* cross-file edges, not
the extractor's own edge/probe. Adds a lexical _within_tree gate: form 3
rejects `..` outright (its base is a guess), and a tracked form-4 base may
reach a sibling via $VAR/../lib but cannot escape past base.parent. Adds two
traversal-rejection tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-08-14 14:48:56 +01:00

..

fixtures

fix: JS/Kotlin/Swift/SQL extractor correctness batch; bump to 0.9.38 (#2568, #2565, #2561, #2577, #2575)

2026-08-09 23:19:08 +01:00

__init__.py

…

bench_extract.py

…

bench_query_scoring.py

test(serve): rebase #1900 test onto #1918 _score_query API; bench newline

2026-07-15 15:09:17 +01:00

conftest.py

test: probe-and-skip symlink tests where symlink creation is unavailable (#2642)

2026-08-12 20:56:28 +01:00

test_affected_cli.py

fix(affected): resolve a seed given as ./relative or absolute path form (#2584 follow-up)

2026-08-13 13:30:24 +01:00

test_affected_member_seed.py

…

test_agents_platform.py

…

test_analyze.py

…

test_anthropic_custom_endpoint.py

…

test_antigravity_install.py

fix(install): stop hardcoding the global skill path in the Antigravity workflow (#2319)

2026-07-30 17:13:48 +01:00

test_apm_fallback_version.py

fix(manifest): capture package version in the apm.yml fallback parser (#2465)

2026-08-13 14:17:41 +01:00

test_architecture_doc.py

docs: refresh ARCHITECTURE.md module table + add a doc-parity test (keeps the #2558 'an' fix)

2026-08-12 20:57:39 +01:00

test_astro_extraction.py

…

test_astro_import_ids.py

fix(extract): canonicalize regex-rescue import target ids (#2195)

2026-07-26 11:52:20 +01:00

test_atomic_writes.py

test: probe-and-skip symlink tests where symlink creation is unavailable (#2642)

2026-08-12 20:56:28 +01:00

test_backend_extras.py

…

test_benchmark_raw_graph.py

fix: load raw edges-keyed graphs + stop pruning alive files as deleted (#2212, #2210)

2026-07-27 10:46:47 +01:00

test_benchmark.py

fix(benchmark): guard against a node with a None label (#2674)

2026-08-12 14:20:21 +01:00

test_build_merge_hyperedges_and_prune.py

fix(build): form-insensitive prune + scan-root marker (#2012)

2026-07-20 13:29:54 +01:00

test_build_merge_shrink_guard.py

fix(build_merge): revive the #479 shrink guard and fix absolute-path prune (#2497, #2446)

2026-08-06 17:29:18 +01:00

test_build.py

fix(build): exclude global MCP ids from legacy-id detection (#2408)

2026-08-13 14:17:42 +01:00

test_builtin_global_type_refs.py

…

test_cache.py

fix(cache): surface corrupt semantic cache entries instead of silently missing (#2683)

2026-08-13 13:30:24 +01:00

test_callflow_html.py

fix(callflow,query): direction-aware callflow; drop relational-verb seed pollution; bump to 0.9.35

2026-08-06 17:29:18 +01:00

test_cargo_introspect.py

…

test_case_sensitive_resolution.py

…

test_charmap_encoding.py

…

test_chunking.py

fix(cache): don't promote truncated LLM chunks to the semantic cache as complete

2026-07-16 23:48:07 +01:00

test_cjs_module_extension.py

fix: treat .cjs (explicit CommonJS) as a code extension

2026-07-15 13:13:30 +01:00

test_claude_cli_backend.py

fix(update,llm): retry failed extractions; surface claude-cli envelope errors; bump to 0.9.37 (#2543, #2554)

2026-08-08 23:37:49 +01:00

test_claude_md.py

fix(install): fire the search nudge on Claude Code's Grep tool, not just Bash (#1986)

2026-07-18 19:07:16 +01:00

test_cli_broken_pipe.py

…

test_cli_export.py

fix(cli): surface four silent success-exit failures (#2534)

2026-08-07 22:49:25 +01:00

test_cluster.py

…

test_codebuddy.py

fix(install): fire the search nudge on Claude Code's Grep tool, not just Bash (#1986)

2026-07-18 19:07:16 +01:00

test_community_hub_labels.py

…

test_community_labels_skill.py

fix(hyperedge,skill): merge/load hyperedge integrity + community labels; bump to 0.9.34

2026-08-05 22:08:29 +01:00

test_confidence.py

…

test_corrupt_graph_json.py

…

test_cpp_objc_cross_file_calls.py

…

test_cpp_preprocess.py

test: Windows path portability in tests; llm emits POSIX source_file to the model (#2620)

2026-08-12 20:56:28 +01:00

test_cross_extension_reexport_self_cycle.py

fix(resolution): repoint cross-extension re-exports without leaking an absolute path (#1814)

2026-07-18 12:04:23 +01:00

test_cross_language_call_resolution.py

…

test_csharp_member_calls.py

fix(csharp): scope receiver types per declaration so an untypeable rebind can't drop a true call (#2472)

2026-08-05 22:08:29 +01:00

test_csharp_partial_classes.py

fix(extract,watch): C# assembly-aware partial merge, incremental edge preservation, extract crash recovery; bump to 0.9.33

2026-08-05 01:41:12 +01:00

test_csharp_type_resolution.py

…

test_dart.py

…

test_dedup.py

fix(dedup): don't over-merge distinct same-file labels differing by a content word (#2576)

2026-08-10 18:06:50 +01:00

test_detect.py

test: skip the unreadable-dir detect test on non-POSIX / as root

2026-08-12 20:56:28 +01:00

test_devin.py

…

test_dotnet.py

fix(csharp): extract members inside #if preprocessor blocks (#2634)

2026-08-11 20:09:59 +01:00

test_evidence_binding.py

fix(llm): move the unverifiable-node flag to a real, consumed field (follow-up to #1949)

2026-07-17 00:09:02 +01:00

test_explain_cli.py

fix: explain no longer resolves an ambiguous name to an arbitrary file

2026-07-30 17:13:48 +01:00

test_export_path_length.py

harden(export): widen dedup reserve to 5 and add multibyte budget test (#2655)

2026-08-14 14:26:12 +01:00

test_export.py

fix(html): trace hyperedge perimeter in convex-hull order (#2449)

2026-08-13 14:17:42 +01:00

test_extract_cache_location.py

…

test_extract_cli.py

fix(update,llm): retry failed extractions; surface claude-cli envelope errors; bump to 0.9.37 (#2543, #2554)

2026-08-08 23:37:49 +01:00

test_extract_code_only_cli.py

fix(detect): stop the sensitive-file filter from dropping topic docs and real source (#2106)

2026-07-22 18:40:11 +01:00

test_extract.py

harden(bash): stop .. source paths escaping the corpus tree (#2596)

2026-08-14 14:48:56 +01:00

test_extraction_spec_ids.py

…

test_extractors_registry.py

…

test_falkordb_integration.py

…

test_file_label_disambiguation.py

fix(cli): disambiguate file labels on the --no-cluster extract path too (#2032)

2026-07-20 16:35:14 +01:00

test_file_node_id_spec.py

…

test_file_slice.py

…

test_gemini_hook.py

…

test_global_graph.py

fix: preserve edge direction in merge-graphs

2026-07-29 17:02:00 +01:00

test_go_builtin_call_targets.py

fix(go): scope the predeclared-function filter to Go bare identifiers

2026-07-30 17:13:48 +01:00

test_go_qualified_resolution.py

fix(go): resolve qualified symbols by import path

2026-08-11 14:40:01 +01:00

test_god_nodes_cli.py

fix(cli): wire god-nodes subcommand + accept --output alias on extract (#2004)

2026-07-20 15:35:40 +01:00

test_google_workspace.py

…

test_home_sandbox.py

fix(install): scope uninstall to project_dir instead of always deleting the global skill (#2215)

2026-07-27 10:46:47 +01:00

test_hook_guard.py

…

test_hook_strict.py

fix(install): fire the search nudge on Claude Code's Grep tool, not just Bash (#1986)

2026-07-18 19:07:16 +01:00

test_hooks.py

test(hooks): stop argv mangling the shell-arg verdict test on Windows (#2126)

2026-08-12 20:56:28 +01:00

test_hyperedge_member_shapes.py

fix(hyperedge,skill): merge/load hyperedge integrity + community labels; bump to 0.9.34

2026-08-05 22:08:29 +01:00

test_hyperedge_roundtrip.py

fix(hyperedge,skill): merge/load hyperedge integrity + community labels; bump to 0.9.34

2026-08-05 22:08:29 +01:00

test_hypergraph.py

…

test_id_normalization_contract.py

fix(normalize_id): address idempotency issues with Turkish identifiers and update related test cases

2026-08-11 15:18:33 +01:00

test_image_vision.py

test: probe-and-skip symlink tests where symlink creation is unavailable (#2642)

2026-08-12 20:56:28 +01:00

test_import_extension_resolution.py

…

test_import_self_loops.py

fix: drop collapsed import self-loops

2026-07-20 11:29:22 +01:00

test_incomplete_build_guard.py

fix(extract): incremental --no-cluster merges instead of overwriting the graph (#2169)

2026-07-25 22:53:43 +01:00

test_incremental_mtime_collision.py

fix(detect): re-queue a same-tick same-length rewrite in incremental runs (#2466)

2026-08-13 14:21:22 +01:00

test_incremental.py

fix(extract): stamp target_file on Python imports and markdown refs so incremental targets canonicalize (#2211, #2213)

2026-07-27 10:46:47 +01:00

test_indirect_call_arrow_single_param_shadow.py

fix(extract): shadow a single unparenthesised arrow parameter from indirect_call args

2026-08-11 15:18:33 +01:00

test_indirect_call_catch_binding_shadow.py

fix(extract): shadow JS/TS catch bindings from indirect_call args (#2568 family)

2026-08-11 16:54:35 +01:00

test_indirect_call_for_of_binding_shadow.py

fix(js): shadow for...of / for...in loop bindings from indirect_call args (#2568 family)

2026-08-13 13:30:24 +01:00

test_indirect_call_nested_closure_shadow.py

fix(extract): shadow untracked JS/TS closure params from indirect_call args (#2241)

2026-07-28 09:37:39 +01:00

test_indirect_dispatch_assign_return.py

…

test_indirect_dispatch_getattr.py

…

test_indirect_dispatch.py

fix(extract,watch): C# assembly-aware partial merge, incremental edge preservation, extract crash recovery; bump to 0.9.33

2026-08-05 01:41:12 +01:00

test_ingest.py

…

test_install_references.py

fix(install): make the staged skill bundle writable so a read-only package installs (#2453)

2026-08-13 14:17:42 +01:00

test_install_roundtrip.py

…

test_install_strings.py

…

test_install_upgrade.py

…

test_install.py

fix: document the Codex PreToolUse hook as an intentional no-op (#2165)

2026-07-26 11:10:35 +01:00

test_java_member_calls.py

…

test_java_type_resolution.py

fix(update,java): prune newly-ignored files; stop external-annotation/local-class conflation (#2495, #2504)

2026-08-06 17:29:18 +01:00

test_js_callback_calls.py

fix: JS/Kotlin/Swift/SQL extractor correctness batch; bump to 0.9.38 (#2568, #2565, #2561, #2577, #2575)

2026-08-09 23:19:08 +01:00

test_js_dynamic_import_affected.py

fix(extract): affected traverses in-function dynamic imports; Python member-call gating; ObjC resolver arm; bump to 0.9.39 (#2584, #2586, #2589, #2591)

2026-08-10 18:07:20 +01:00

test_js_dynamic_imports.py

fix(extract): affected traverses in-function dynamic imports; Python member-call gating; ObjC resolver arm; bump to 0.9.39 (#2584, #2586, #2589, #2591)

2026-08-10 18:07:20 +01:00

test_js_exported_scalar_bindings.py

fix(extract): emit nodes for exported scalar bindings

2026-07-30 17:13:48 +01:00

test_js_import_resolution.py

fix(js): stabilize unresolved local import target ids (#2457)

2026-08-12 14:20:21 +01:00

test_jsconfig_baseurl.py

test(resolution): assert canonical import-target ids in jsconfig tests (follow-up to #2169)

2026-07-25 23:16:52 +01:00

test_kotlin_grammar.py

fix(extract): gate the #2551 partial-parse warning on plausible symbol loss (#2610, #2599)

2026-08-11 15:18:12 +01:00

test_kotlin_object_literal.py

fix(extract): C# inline-declared + partial-class receivers, Kotlin anonymous-object members (#2346, #2332, #2347)

2026-08-01 12:21:04 +01:00

test_label_retry.py

…

test_labeling.py

fix(cli): surface four silent success-exit failures (#2534)

2026-08-07 22:49:25 +01:00

test_language_resolvers.py

…

test_languages.py

fix(extract): nested types get a contains edge from the enclosing type (#2040)

2026-07-20 15:40:32 +01:00

test_llm_backends.py

fix(llm): add rationale guidance to the API extraction prompt (#2482)

2026-08-11 16:54:35 +01:00

test_llm_parser.py

…

test_long_path_hashing.py

…

test_manifest_ingest.py

fix(ingest): recognize Cargo.toml as a package manifest (#2434)

2026-08-11 16:54:35 +01:00

test_mcp_ingest.py

…

test_merge_chunks_validation.py

fix(merge-chunks): fail when no chunk validates

2026-07-17 10:54:07 +01:00

test_merge_graphs_cli.py

fix(hyperedge,skill): merge/load hyperedge integrity + community labels; bump to 0.9.34

2026-08-05 22:08:29 +01:00

test_minhash.py

…

test_multigraph_compat.py

…

test_multigraph_diagnostics.py

…

test_multilang.py

fix: JS/Kotlin/Swift/SQL extractor correctness batch; bump to 0.9.38 (#2568, #2565, #2561, #2577, #2575)

2026-08-09 23:19:08 +01:00

test_node_id_canonical.py

fix(extract): parse .tsx with the TSX grammar so symbol-resolution stops leaking absolute-slug ids (#2262)

2026-07-29 17:25:08 +01:00

test_non_regular_files.py

fix(detect): skip non-regular files so a FIFO can't hang extraction (#2463)

2026-08-13 14:20:36 +01:00

test_non_string_node_ids.py

fix(build): coerce non-string node ids so a numeric id cannot abort the build

2026-08-01 11:36:30 +01:00

test_objc_category_interfaces.py

fix(objc): protocol not a receiver type, category fold, property/ivar receivers (#2589, #2590, #2591)

2026-08-10 18:06:50 +01:00

test_objc_member_calls.py

fix(objc): protocol not a receiver type, category fold, property/ivar receivers (#2589, #2590, #2591)

2026-08-10 18:06:50 +01:00

test_objc_property_ivar_receivers.py

fix(objc): protocol not a receiver type, category fold, property/ivar receivers (#2589, #2590, #2591)

2026-08-10 18:06:50 +01:00

test_obsidian_dangling_member.py

…

test_obsidian_filename_cap.py

…

test_ocaml.py

feat(ocaml): add OCaml .ml/.mli extractor (optional tree-sitter-ocaml extra)

2026-08-14 14:17:07 +01:00

test_office_incremental.py

…

test_office_limits.py

…

test_ollama_retry_cap.py

…

test_ollama.py

…

test_openai_custom_endpoint.py

…

test_partial_cache.py

fix(update,llm): retry failed extractions; surface claude-cli envelope errors; bump to 0.9.37 (#2543, #2554)

2026-08-08 23:37:49 +01:00

test_pascal_call_scoping.py

…

test_pascal_resolution.py

…

test_pascal.py

…

test_path_cli.py

fix(path): respect edge direction by default in path and shortest_path (#2487)

2026-08-05 22:08:29 +01:00

test_paths.py

fix(paths): implement cross-platform absolute path detection for stored paths

2026-08-11 14:40:01 +01:00

test_pg_introspect.py

fix(pg_introspect): emit FK DDL before function stubs so unparseable routines can't drop references edges (#1854)

2026-07-16 16:36:49 +01:00

test_phantom_cross_package_call.py

…

test_phantom_external_import.py

…

test_php_type_resolution.py

fix(extract): resolve prefixed PHP use-imports to their target (#2661)

2026-08-12 14:20:21 +01:00

test_pipeline.py

…

test_provider_registry.py

…

test_prs.py

fix(prs): decode gh/git/claude output as UTF-8, not the Windows cp1252 codec

2026-07-18 12:03:47 +01:00

test_python_decorators.py

fix(extract): suppress builtin/stdlib Python decorators from reference edges (follow-up to #2154)

2026-07-25 22:53:43 +01:00

test_python_import_resolution.py

fix(python): resolve relative subpackage imports to their __init__ (#2688)

2026-08-13 13:30:24 +01:00

test_query_cli.py

fix: preserve calls edge direction in graphify query output

2026-07-21 21:45:53 +01:00

test_query_induced_edges.py

fix(query): render every edge between visited nodes, not just traversal edges

2026-08-01 11:36:30 +01:00

test_querylog.py

…

test_rationale.py

fix(extract): normalize whitespace before truncating rationale labels (#2206)

2026-07-28 09:37:39 +01:00

test_read_hook.py

…

test_reflect.py

…

test_replace_or_append_section.py

…

test_report.py

fix(report): use a portable basename in the GRAPH_REPORT header (#2682)

2026-08-13 13:30:24 +01:00

test_ruby_resolution.py

fix(ruby): resolve compact/nested mixin targets, prevent phantom concern hub (#2302)

2026-08-01 15:36:17 +01:00

test_scala_self_type.py

fix(scala): dispatch self-type annotations to requires edges (#2052)

2026-07-28 09:37:39 +01:00

test_scip_ingest.py

…

test_search_hook.py

fix(install): fire the search nudge on Claude Code's Grep tool, not just Bash (#1986)

2026-07-18 19:07:16 +01:00

test_security.py

…

test_semantic_cache_out_root.py

fix(cache): anchor semantic cache writes to cache_root so --out round-trips (#1990, #1991)

2026-07-18 19:09:53 +01:00

test_semantic_cleanup.py

fix(merge-chunks): validate untrusted subagent chunk JSON before merging

2026-07-16 23:36:49 +01:00

test_semantic_fragment_sanitize.py

…

test_semantic_id_remap_root.py

fix(build): make _semantic_id_remap idempotent to stop id accretion (#1917)

2026-07-15 15:14:34 +01:00

test_semantic_similarity.py

…

test_serve_http.py

fix(serve): bound multi-project graph contexts (#2268)

2026-07-29 17:02:00 +01:00

test_serve.py

fix(serve): suppress the query truncation banner when no nodes were cut (#2601)

2026-08-12 14:20:21 +01:00

test_settings_merge.py

fix(install): never clobber an unparseable settings file; back up before write (#2167)

2026-07-25 22:53:43 +01:00

test_skill_version_warning.py

…

test_skillgen.py

fix(skill): make the Windows skill variant runnable on PowerShell; bump to 0.9.36 (#2528)

2026-08-07 22:49:51 +01:00

test_src_layout_import_resolution.py

fix(extract): harden #2072 src-layout resolution (adversarial-review fixes)

2026-07-21 14:22:50 +01:00

test_stale_prune.py

fix: load raw edges-keyed graphs + stop pruning alive files as deleted (#2212, #2210)

2026-07-27 10:46:47 +01:00

test_stat_index_portability.py

fix(cache): implement racily-clean guard for file hashing; enhance stat signature checks

2026-08-11 14:40:01 +01:00

test_swift_builtin_noise.py

fix(extract,analyze): filter Swift/Foundation/SwiftUI builtins from resolution and god-node ranking (#2147)

2026-07-25 15:44:50 +01:00

test_swift_computed_properties.py

fix(swift): extract computed & observed properties (#2181)

2026-07-27 10:22:48 +01:00

test_swift_cross_file_calls.py

fix: JS/Kotlin/Swift/SQL extractor correctness batch; bump to 0.9.38 (#2568, #2565, #2561, #2577, #2575)

2026-08-09 23:19:08 +01:00

test_swift_import_resolution.py

…

test_symbol_resolution.py

…

test_terraform.py

…

test_transcribe.py

…

test_tree_html.py

fix(cli): surface four silent success-exit failures (#2534)

2026-08-07 22:49:25 +01:00

test_ts_decorators.py

…

test_ts_generators.py

…

test_ts_import_require.py

…

test_ts_inheritance.py

…

test_ts_namespace.py

…

test_ts_parse_warning.py

fix(extract): gate the #2551 partial-parse warning on plausible symbol loss (#2610, #2599)

2026-08-11 15:18:12 +01:00

test_ts_receiver_member_calls.py

fix(extract): TS member-call gating + Kotlin grammar match (#2553, #2552, #2526, #2550, #2551)

2026-08-08 23:37:32 +01:00

test_typescript_module_extensions.py

…

test_uninstall_scope.py

fix(install): scope uninstall to project_dir instead of always deleting the global skill (#2215)

2026-07-27 10:46:47 +01:00

test_validate.py

fix(build): fold legacy node/edge aliases and re-key absolute-derived semantic ids (#2194, #2197)

2026-07-26 11:52:20 +01:00

test_vue_extraction.py

…

test_watch_manifest_location.py

test(watch): cover manifest location, anchor and commit provenance (#2316)

2026-08-01 11:36:30 +01:00

test_watch.py

test: Windows path portability in tests; llm emits POSIX source_file to the model (#2620)

2026-08-12 20:56:28 +01:00

test_wheel_packaging.py

…

test_wiki_link_filename_parity.py

test(wiki): make the bracketed-label parity case non-vacuous (#2597)

2026-08-14 14:21:34 +01:00

test_wiki.py

fix(wiki): make a link target the article filename verbatim, not its percent-encoded twin (#2597)

2026-08-14 14:20:04 +01:00

test_word_count_cache.py

fix(cache): implement racily-clean guard for file hashing; enhance stat signature checks

2026-08-11 14:40:01 +01:00

test_zero_node_no_cache.py

…