feat: impact resolves callers, reads staged snapshots, bounds git

Agents grepped for "who calls X" because every diffctx entry point needed
a change to anchor on. `--symbol NAME|PATH:NAME` (CLI, MCP `symbol`)
anchors impact on a name's definitions instead: where it is defined, who
calls it, the tests that reach each caller. The MCP tool defaults to
impact, which its own description promised; a base install's
`diffctx-mcp` names the missing extra instead of dying on `import anyio`,
and answers `--version`.

A caller was a spelling match: a name in a string or a comment,
`re.search` for a changed `search`, `update.message` for `Bot.message`,
the other app's `App.tsx`, `legacy/pricing.py` for `shop/pricing.py`.
In Python and JS/TS a caller is now resolved through the import that
carries it — relative and absolute imports, aliases, re-exports,
`require`, `tsconfig` paths read as data — and a method through its
receiver: `self`/`this` in the class or a subclass, the class itself, a
variable constructed or annotated as it. An unresolved import or receiver
is a possible caller with its reason, never a definite one; other
languages keep the name model and say so. A name defined everywhere, or a
trait method reached through `dyn`, says its callers were not resolved
instead of reading as uncalled, and an empty answer is scoped: no resolved
static caller in the analysed scope. Test links say what static analysis
shows — "reachable from tests", "no static test link found" — never
coverage. The alias edges reach the graph too, so pack and locate see an
aliased call.

`--diff staged` (also `--diff=--cached`, MCP `diff_ref="staged"`)
captures the index once as a tree and answers for it alone: an explicit
range is now read from its own head tree — the file universe, discovery,
the edge builders, the fragments, the stale-reference search — and never
from the disk. An unborn branch diffs against the empty tree of its object
format, an unmerged index is an error, and impact names the index tree.
Impact asks git about the resolved range, so a `24h` window no longer
asks about a revision named `24h`.

A stalled git could hang a run for hours: every git child now gets what is
left of one run deadline, its pipes are read on threads, its whole process
group is killed, a cat-file stream that lost its framing is discarded and
the file re-read, an interrupted read is reported instead of filled from
disk, MCP cancellation stops the native run, and the corpus harness names
a case that outlives its limit.

The plugin hook keys an answer by a content-addressed result identity, so
every spelling of one snapshot shares it and any new byte is answered at
once; it records an answer only when delivered, retries a timeout or a
partial answer at most twice, reminds at a commit only when its target is
exactly what was shown, ignores piped and summary-only views, labels a
`-a` or `add && commit` preview as one and checks the commit that lands,
logs git hidden in a subshell, fits its answer to 600 tokens, answers a
search for an edited name, and reviews --amend against HEAD~1.

Python call edges cleared the naming floor almost never: an import
confirmed only the fragment that held it. Confirmation is per file,
discovery follows the changed files' own imports and no longer pulls in a
whole package. Coverage says partial only when a limit touched what the
answer is about, and names the file; locate's JSON fits its budget;
co-change history is read before the range's head; only a file with a
grammar can be unparsed.

Also: reverse discovery reads func/fun and Java/C# methods, not locals;
the tags fallback no longer links code by syntax words; rescue lets a
signature stand in for a caller's body; deleted files and lines still
naming a deleted or renamed path are reported; publish-extras restores a
pruned tag and a drafted release; the site serves a favicon; Renovate
leaves plugin/constraints.txt to uv.lock; setup-uv 10.2.0, tiktoken-rs
0.12.1, thiserror 2.0.21, ruff 0.16.10, pylint 4.0.10; the packaging
manifests for 1.18.2.

Refs: #300, #306, #313, #317, #319, #321, #330, #332, #333, #334, #335,
#336, #337, #338, #339, #340, #341, #342, #343, #344, #345, #346, #347,
#348, #349, #350, #351, #353, #354, #356, #360; #355, #357, #358, #359,
#361, #362 filed.

Claude-Session: https://claude.ai/code/session_01LC9cvWcY1L9YJ1SJB6pBez

Author: nikolay-e

.github/workflows/cd.yml

@@ -245,7 +245,7 @@ jobs:
           grep -n -m3 -E '^## \[' CHANGELOG.md
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
 
       # The plugin's uvx launcher pins diffctx; this pins what diffctx pulls
       # in, to the set CI installed from uv.lock, so an installed plugin runs
@@ -740,7 +740,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
 
       - name: Wait for PyPI propagation and install
         shell: bash
@@ -813,6 +813,33 @@ jobs:
           grep -q "def sub" "${RUNNER_TEMP}/uvx.md"
           echo "OK: uvx runs the published wheel"
 
+      # A console script cannot depend on an extra, so the base install ships
+      # diffctx-mcp too; it must answer --version and name the extra rather
+      # than die on `import anyio` (#333). A fresh venv, so nothing the runner
+      # or an earlier step installed can stand in for the missing extra.
+      - name: Smoke - diffctx-mcp from a base install
+        shell: bash
+        env:
+          VERSION: ${{ needs.prepare-version.outputs.version }}
+        run: |
+          python -m venv "${RUNNER_TEMP}/base"
+          bin="${RUNNER_TEMP}/base/bin"
+          [[ -d "$bin" ]] || bin="${RUNNER_TEMP}/base/Scripts"
+          "$bin/python" -m pip install --only-binary :all: "diffctx==${VERSION}"
+          test "$("$bin/diffctx-mcp" --version)" = "diffctx-mcp ${VERSION}"
+          set +e
+          "$bin/diffctx-mcp" --help >/dev/null 2>&1
+          help_rc=$?
+          "$bin/diffctx-mcp" </dev/null 2>"${RUNNER_TEMP}/base-mcp.err"
+          rc=$?
+          set -e
+          cat "${RUNNER_TEMP}/base-mcp.err"
+          test "$help_rc" -eq 0
+          test "$rc" -eq 3
+          grep -q "diffctx\[mcp\]" "${RUNNER_TEMP}/base-mcp.err"
+          if grep -q Traceback "${RUNNER_TEMP}/base-mcp.err"; then exit 1; fi
+          echo "OK: base install's diffctx-mcp names the extra"
+
       # server.json, .mcp.json and the Claude plugin all resolve to
       # `uvx --from diffctx[mcp] diffctx-mcp`, but nothing here installed the
       # [mcp] extra or ran the console script — so renaming the entry point, or
@@ -935,7 +962,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
 
       - name: Install from the cp314t wheel, never the sdist
         shell: bash
@@ -1118,12 +1145,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.prepare-version.outputs.version }}
-          TAG_NAME: ${{ needs.prepare-version.outputs.tag_name }}
+          COMMIT_SHA: ${{ needs.prepare-version.outputs.commit_sha }}
           REPO: ${{ github.repository }}
         run: |
           gh workflow run publish-crate.yml \
             --repo "$REPO" --ref main \
-            -f version="$VERSION" -f ref="$TAG_NAME"
+            -f version="$VERSION" -f ref="$COMMIT_SHA"
 
       - name: Wait for the crate publish workflow
         env:
@@ -1145,13 +1172,14 @@ jobs:
       id-token: write
       contents: read
     steps:
-      # The release tag, not main: finalize-release commits the bumped
+      # The release commit, not main: finalize-release commits the bumped
       # server.json there, and registry versions are immutable — publishing
-      # main mid-release would race the bump commit.
-      - name: Checkout release tag
+      # main mid-release would race the bump commit. Not the tag either: it
+      # has been pruned minutes after the push (#332).
+      - name: Checkout release commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          ref: ${{ needs.prepare-version.outputs.tag_name }}
+          ref: ${{ needs.prepare-version.outputs.commit_sha }}
 
       # Release assets are named linux_amd64/arm64 (Go convention), NOT the
       # uname -m x86_64/aarch64 — a naive $(uname -m) URL 404s. Pinned by
@@ -1196,10 +1224,10 @@ jobs:
     env:
       IMAGE: ghcr.io/${{ github.repository_owner }}/diffctx
     steps:
-      - name: Checkout release tag
+      - name: Checkout release commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          ref: ${{ needs.prepare-version.outputs.tag_name }}
+          ref: ${{ needs.prepare-version.outputs.commit_sha }}
 
       - name: Set up Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
@@ -1435,7 +1463,7 @@ jobs:
   publish-extras:
     name: Publish npm wrapper and mirror to Docker Hub
     # No edge to update-packaging-manifests: publish-extras.yml re-renders the
-    # npm checksums from the release tag, so a Scoop bucket failure can never
+    # npm checksums from the release assets, so a Scoop bucket failure can never
     # hold back npm or the Docker Hub mirror.
     needs: [prepare-version, publish-image]
     if: github.event.inputs.publish_to_pypi == 'true'
@@ -1451,11 +1479,13 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.prepare-version.outputs.version }}
+          COMMIT_SHA: ${{ needs.prepare-version.outputs.commit_sha }}
           REPO: ${{ github.repository }}
         run: |
           gh workflow run publish-extras.yml \
             --repo "$REPO" --ref main \
             -f version="$VERSION" \
+            -f commit="$COMMIT_SHA" \
             -f publish_npm=true \
             -f mirror_dockerhub=true
 

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: '3.12'
           enable-cache: true
@@ -212,7 +212,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: '3.10'
           enable-cache: true
@@ -372,7 +372,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up uv with Python ${{ matrix.python-version }}
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: ${{ matrix.python-version }}
           enable-cache: true
@@ -462,7 +462,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: '3.12'
           enable-cache: true
@@ -495,7 +495,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: '3.12'
           enable-cache: true
@@ -535,7 +535,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: '3.12'
           enable-cache: true

.github/workflows/publish-extras.yml

@@ -13,6 +13,10 @@ concurrency:
       version:
         description: 'Released version to publish downstream (e.g. 1.12.1)'
         required: true
+      commit:
+        description: 'Release commit SHA (default: the tag, else the "Release version X" commit on main)'
+        required: false
+        default: ''
       publish_npm:
         description: 'Publish the npm wrapper'
         required: true
@@ -31,29 +35,109 @@ concurrency:
           - 'false'
 
 jobs:
+  # The release tag has been deleted under a published release (a Forgejo push
+  # mirror pruned v1.16.0 and v1.18.2 minutes after CD pushed it), which drafts
+  # the release: install.js and Scoop then 404 on releases/download/vX, and a
+  # checkout of the tag fails (#332). So nothing downstream reads the tag: the
+  # commit and the release are resolved independently of it, and a missing tag
+  # or a drafted release is restored here, loudly, before anything publishes.
+  release:
+    name: Resolve the release and keep it published
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      commit: ${{ steps.resolve.outputs.commit }}
+      release_id: ${{ steps.resolve.outputs.release_id }}
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Resolve the release commit and the GitHub release
+        id: resolve
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ github.event.inputs.version }}
+          COMMIT: ${{ github.event.inputs.commit }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          export TAG="v${VERSION}"
+          # An epoch squash re-anchors old tags and drops their "Release
+          # version" commits, so the subject is only the fallback for a tag
+          # pruned right after its release.
+          SUBJECT="Release version ${VERSION}"
+          [ -n "$COMMIT" ] || COMMIT=$(git rev-parse -q --verify "refs/tags/${TAG}^{commit}" || true)
+          [ -n "$COMMIT" ] || COMMIT=$(git log origin/main --format='%H%x09%s' \
+            | awk -F'\t' -v s="$SUBJECT" '$2 == s && !n++ { print $1 }')
+          [ -n "$COMMIT" ] || { echo "no ${TAG} tag and no '${SUBJECT}' commit on main"; exit 1; }
+          COMMIT=$(git rev-parse --verify "${COMMIT}^{commit}")
+          git merge-base --is-ancestor "$COMMIT" origin/main \
+            || { echo "${COMMIT} is not on main"; exit 1; }
+          RELEASE_ID=$(gh api "repos/${REPO}/releases?per_page=100" \
+            --jq '[.[] | select(.tag_name == env.TAG or .name == "Release " + env.VERSION)][0].id // empty')
+          [ -n "$RELEASE_ID" ] || { echo "no GitHub release for ${TAG}"; exit 1; }
+          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
+          echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
+          echo "${TAG}: commit ${COMMIT}, release ${RELEASE_ID}"
+
+      - name: Restore a pruned tag and a drafted release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ github.event.inputs.version }}
+          COMMIT: ${{ steps.resolve.outputs.commit }}
+          RELEASE_ID: ${{ steps.resolve.outputs.release_id }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          TAG="v${VERSION}"
+          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null; then
+            [ "$(git rev-parse "${TAG}^{commit}")" = "$COMMIT" ] \
+              || { echo "${TAG} points at $(git rev-parse "${TAG}^{commit}"), not ${COMMIT}"; exit 1; }
+          else
+            git config user.name "github-actions[bot]"
+            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            git tag -a "$TAG" -m "Release version ${VERSION}" "$COMMIT"
+            git push origin "refs/tags/${TAG}"
+            echo "::warning::${TAG} was missing on GitHub; recreated at ${COMMIT}. Push it to Forgejo too."
+          fi
+          if [ "$(gh api "repos/${REPO}/releases/${RELEASE_ID}" --jq .draft)" = true ]; then
+            gh api -X PATCH "repos/${REPO}/releases/${RELEASE_ID}" \
+              -f tag_name="$TAG" -F draft=false -f make_latest=legacy >/dev/null
+            echo "::warning::release ${TAG} was a draft; published it again"
+          fi
+          [ "$(gh api "repos/${REPO}/releases/tags/${TAG}" --jq .id)" = "$RELEASE_ID" ]
+
   npm:
     name: Publish npm wrapper
+    needs: release
     if: github.event.inputs.publish_npm == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
-      - name: Checkout release tag
+      - name: Checkout release commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          ref: v${{ github.event.inputs.version }}
+          ref: ${{ needs.release.outputs.commit }}
 
       - name: Download release binaries
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ github.event.inputs.version }}
+          RELEASE_ID: ${{ needs.release.outputs.release_id }}
         run: |
+          set -euo pipefail
           mkdir -p release-binaries
-          gh release download "v${VERSION}" \
-            --repo "${GITHUB_REPOSITORY}" \
-            --dir release-binaries \
-            --pattern 'diffctx-*-*.tar.gz' --pattern 'diffctx-*-*.zip'
+          gh api "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
+            --jq '.assets[] | select(.name | test("^diffctx-.+-.+[.](tar[.]gz|zip)$")) | "\(.id) \(.name)"' \
+            | while read -r id name; do
+                gh api -H 'Accept: application/octet-stream' \
+                  "repos/${GITHUB_REPOSITORY}/releases/assets/${id}" > "release-binaries/${name}"
+              done
           ls -la release-binaries
 
       - name: Set up Python

.github/workflows/sensitivity-check.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7  # v10.2.0
         with:
           python-version: '3.12'
           enable-cache: true

.pre-commit-config.yaml

@@ -140,7 +140,7 @@ repos:
   # LINTING (Ruff for speed + correctness)
   # ============================================================================
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.8
+    rev: v0.16.10
     hooks:
       - id: ruff
         name: ruff (correctness-focused checks)
@@ -227,7 +227,7 @@ repos:
   # CODE DUPLICATION DETECTION
   # ============================================================================
   - repo: https://github.com/PyCQA/pylint
-    rev: v4.0.8
+    rev: v4.0.10
     hooks:
       - id: pylint
         name: pylint (duplicate code detection)