sync: release/v1.5.2 — fork master forward to upstream v1.5.2 (policy-compliant source)

.cargo/config.toml

@@ -1,3 +1,9 @@
 [build]
 # Place target directory outside the repository to keep source tree clean
 target-dir = "../target"
+
+# Fast debug builds: rust-lld links several times faster than link.exe.
+# Debug-only policy (issue #192): release builds ship via release.yml and are
+# built there explicitly, never locally.
+[target.x86_64-pc-windows-msvc]
+linker = "rust-lld"

.github/workflows/bump-develop.yml

@@ -75,7 +75,7 @@ jobs:
           echo "new=$NEW" >> "$GITHUB_OUTPUT"
           echo "::notice::Bump $CURRENT -> $NEW"
 
-      - name: Bump version in Cargo.toml + Cargo.lock
+      - name: Bump version in Cargo.toml, Cargo.lock + scip-csharp.csproj
         env:
           CURRENT: ${{ steps.ver.outputs.current }}
           NEW: ${{ steps.ver.outputs.new }}
@@ -88,9 +88,15 @@ jobs:
           # dependency versions (unlike `cargo update --workspace`, which would
           # opportunistically bump transitive deps as a side effect).
           sed -i "/^name = \"codesearch\"/,/^version = /{ s/^version = \"$CURRENT\"/version = \"$NEW\"/ }" Cargo.lock
-          # Hard-verify both files now carry the new version before committing.
+          # scip-csharp.csproj — the helper's <Version> feeds its --version line,
+          # the same-build identity the host logs and copy-to-common compares.
+          # Rewrite WHATEVER value is there, never anchor on $CURRENT: once the
+          # files drift apart the substitution silently no-ops forever.
+          sed -i "0,/<Version>[^<]*<\/Version>/s//<Version>$NEW<\/Version>/" helpers/csharp/scip-csharp.csproj
+          # Hard-verify all three files now carry the new version before committing.
           grep -m1 "^version = \"$NEW\"" Cargo.toml >/dev/null
           grep -A1 '^name = "codesearch"$' Cargo.lock | grep -m1 "^version = \"$NEW\"" >/dev/null
+          grep -m1 "<Version>$NEW</Version>" helpers/csharp/scip-csharp.csproj >/dev/null
 
       - name: Commit & push bump
         env:
@@ -100,7 +106,7 @@ jobs:
           set -euo pipefail
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Cargo.toml Cargo.lock
+          git add Cargo.toml Cargo.lock helpers/csharp/scip-csharp.csproj
           # No-op guard (e.g. a re-merge that already left develop at NEW).
           if git diff --cached --quiet; then
             echo "No version change to commit (already at $NEW)."

AGENTS.develop.md

@@ -187,7 +187,7 @@ TUI `i` overlay. The TUI discovery tick is config-only (zero HTTP).
 ## Runtime locations
 
 - **Runtime dir**: `C:\Users\develterf\.local\bin\` — contains `codesearch.exe` and `helpers/csharp/scip-csharp.exe`. This is where `codesearch serve` runs from.
-- **Build:** via `build.ps1` (repo root) — it self-heals the bare-flag quirk and sets `CARGO_TARGET_DIR` so `target/` stays outside the repo.
+- **Build:** via `build.ps1` (repo root) — it self-heals the bare-flag quirk and sets `CARGO_TARGET_DIR` so `target/` stays outside the repo. Debug-only (issue #192): `-Release` is refused, release artifacts come from CI; rust-lld is pinned in `.cargo/config.toml` (bin rebuild ~2x faster).
 - **Build dir**: `target/release/` — lives **outside the repo** (set via `CARGO_TARGET_DIR`). For compilation only. Never run codesearch from this location.
 - **Logs**: `~\.codesearch\logs\` — codesearch writes structured logs here during serve. Check these for startup errors, rebuild failures, and helper detection messages.
 

CHANGELOG.md

@@ -14,6 +14,49 @@ more PRs land; when the release is actually tagged, the same section is
 finalized in place with a date — no renaming/migration step needed.
 -->
 
+## [1.5.2] - 2026-10-05
+
+### Fixed
+
+- **Restore runs only when package assets are missing or stale, and warning-severity workspace diagnostics no longer count as index warnings.** Restoring on every reindex was far too heavy for multi-repo hubs and big solutions legitimately exceed any fixed timeout (`dotnet restore did not finish within 300s` was observed live). Now the helper checks each project's `obj/project.assets.json` against its .csproj and restores only when evidence demands it (the steady state of an actively developed repo is a no-op), the kill timeout is tunable via `CODESEARCH_RESTORE_TIMEOUT_SECS`, and restore uses `--ignore-failed-sources` so an unreachable private feed cannot block indexing. Separately, warning-severity workspace diagnostics (e.g. "Found project reference without a matching metadata reference" for excluded or external projects) are benign resolution notes — they log at INFO and no longer pin the repo's index warning; only true load failures (minus NuGet audit advisories) still do.
+- **C# symbol indexing restores packages before the workspace load, and NuGet audit advisories no longer count as index warnings.** The design-time load does not restore: with stale or missing `project.assets.json`, package-typed references collapsed into CS0246 cascades that flagged whole solution families as degraded (⚠ in the serve TUI) even though `dotnet build` succeeds. The helper now runs `dotnet restore` before opening the solution (bounded, best effort — a failed restore logs and continues, degraded indexing beats no indexing), and when the bounded wait expires the restore is **not killed**: it keeps running in the background, this load proceeds degraded, and the next reindex picks up the fresh assets — a killed restore would waste all of its work and re-pay the same wait on every subsequent reindex. NuGet vulnerability advisories surfacing as Msbuild "failures" are filtered from the warning channel: they are security notes for the product, not index-health signals. Compiler *warnings* were already never counted; genuine project compilation errors still are, and indexing stays as complete as the broken projects allow.
+
+### Changed
+
+- **Dependency refresh:** libc 0.2.190, rmcp 3.5.0, uuid 1.27.0 (#305).
+
+## [1.5.1] - 2026-10-04
+
+### Added
+
+- **`codesearch setup` — download embedding models, and a relocatable global root via `CODESEARCH_HOME`.** The stubbed setup command now resolves `--model` through the shared model parser (unknown names error with the valid list), downloads into the global models cache with a visible progress bar (runtime paths stay silent), and probe-embeds one query so a broken download fails in setup instead of mid-indexing. `CODESEARCH_HOME` relocates the entire global root (repos.json, models cache, logs, serve_url, global ignore/extensions) and is honoured by the hub, db-discovery, every Claude Code guard hook and the OpenCode plugin, with tests pinning each layer. *(Contributed by @belovaf in #298 — in the same PR: find-impact warnings that no longer promise rebuilds nothing will run, group-fan-out hits attributed to their repo, and dependency-lockfile indexing exclusions.)*
+
+*A big thank-you to belovaf ([@belovaf](https://github.com/belovaf)) for his first contribution to this release — a careful, well-tested feature plus four quality fixes landed in one go.*
+
+### Fixed
+
+- **Queued reindexes are no longer cancelled as "leaked", and an unjoinable index task can no longer wedge a hub.** With the process-wide job gate (`CODESEARCH_INDEX_JOBS=1`, the default), tasks queued behind a long-running job held their `active_reindexes` markers past `MAX_INDEXING_SECS` without renewing them, so the lazy stale-marker check evicted the markers and cancelled the parked tasks — leaving empty stores and in-process LMDB handles that made later writes fail with "Database is locked by another process" until a serve restart. Separately, `await_index_task` removed the task entry *before* waiting and dropped the `JoinHandle` on timeout, so a task too deep in the uninterruptible `build_index` to cancel kept its `Arc<SharedStores>` and the single job permit invisibly; the job-gate wait ignored cancellation, parking cancelled tasks on the gate; and `remove_repo` / format recovery could delete the DB directory out from under a still-running task. Now: a marker backed by a live tracked `Reindex` task is renewed (with a throttled wedge warning) instead of reaped; gate acquisition is cancellation-aware (`JobAcquire`) so cancelled or removed queued jobs abort and release their stores; a task that cannot be joined stays tracked and is reaped by a periodic sweeper that also deletes orphaned DB directories and re-asserts cancellation for removed repos; DB deletion is deferred while the task runs; format recovery refuses to wipe in that state; and stale markers from other owners are still evicted.
+
+## [1.5.0] - 2026-10-03
+
+### Added
+
+- **Settable indexing/refresh limits: `CODESEARCH_INDEX_JOBS`, `CODESEARCH_EMBED_THREADS`, `CODESEARCH_EMBED_PAUSE_MS`, `CODESEARCH_MIN_FREE_MB`, `CODESEARCH_MAX_CHUNKS_PER_BATCH` (serve flags `--index-jobs`, `--embed-threads`, `--embed-pause-ms`, `--min-free-mb`).** A multi-repo hub used to start one full refresh/reindex/HNSW-build pass per repo the moment that repo had work, so a mass `git pull`, a burst of first queries or several HTTP reindexes ran many CPU-heavy passes at once, held many file/chunk windows in memory, and queued the (already serialised) ONNX inference behind all of them. A process-wide job gate now bounds concurrent heavy repo jobs (default **1**; queries never take it), the ONNX session's intra-op thread count can be capped (`CODESEARCH_EMBED_THREADS`, previously always all cores), background embedding releases the model lock once per mini-batch with an optional duty-cycle pause so interactive query embeddings are not stuck behind a whole batch, the read/chunk window can be capped by chunks as well as files, and a job can wait for a free-memory floor before starting. See the README section "Indexing limits" for recommended values.
+- **OpenCode plugin integration (`integrations/opencode/`).** codesearch's MCP `initialize` instructions are advisory and connection-scoped: they cannot resolve the session directory to a registered project, see a `grep` return nothing, recover a dead serve hub, notice an unregistered worktree, or keep file outlines alive across compaction. The new self-contained OpenCode v2 plugin (no runtime dependencies, fail-open throughout) adds host-side behaviour around the same MCP server: it resolves the working directory to a project alias and injects scope-aware guidance once per session, turns a zero-hit `grep`/`glob` into index hits, offers `nudge`/`prune`/`block` codesearch-first guards that deny only while the hub is confirmed reachable and the repo is registered, probes `/healthz` and asks OpenCode to reload failed MCP servers (with optional local `codesearch serve` auto-start), warns when a registered index is empty or model-less, notes just-edited files while the watcher catches up, captures `explore` outlines into the compaction prompt, and registers `/codesearch`, `/codesearch-status` and `/codesearch-index` commands, a `codesearch_scope` tool and a `codesearch` skill. Includes a config reference, install/usage docs and a mock-host smoke test.
+
+*A big thank-you to Don Bowman ([@donbowman](https://github.com/donbowman)) for his outstanding, highly value-adding contributions to this release — the indexing-limits rework (#294) and the OpenCode plugin integration (#295), follow-up fixes included.*
+- **Always-on symbol indexes (C# + TypeScript).** Symbol (SCIP) indexes are no longer a manual or incidental artifact: serve warmup, cold opens, file-watcher batches and reindexes each drive a per-language symbol pass wherever chunk indexes are built, so `find_impact` evidence exists without a separate rebuild step. Startup inspects the on-disk symbol indexes with a builder-version stamp and rebuilds those an older binary produced (degraded retry instead of a hard failure), so a upgraded serve never answers from stale symbol data.
+
+### Changed
+
+- **`codesearch serve` runs heavy repo jobs one at a time by default (`CODESEARCH_INDEX_JOBS=1`).** Warmup, cold opens, file-watcher batches and reindexes now queue behind a running refresh instead of all running at once; raise the value deliberately on machines with cores and memory to spare. Standalone `codesearch index` / `codesearch mcp` runs are unchanged (no gate is attached). `CODESEARCH_EMBED_THREADS` unset keeps the previous ONNX default (all cores), so single-repo index throughput is unchanged unless the variable is set.
+- **`find_impact` is honest about partial evidence; the TUI says how healthy the symbol indexes are.** Index-level rebuild warnings (non-compiling C# projects, swallowed resolution failures, non-zero `scip-typescript` exits) ride the `find_impact` answer as an additive `warnings` array instead of vanishing into the log. The scip-csharp helper's workspace-load diagnostics are aggregated into a single warnings line and never escalate to errors during workspace load. The serve TUI's symbol-index indicators use severity language: a degraded C# index renders red (`C#⚠`) and the info line names the failures.
+- **Cloud image: build locally, not via `az acr build`.** The Dockerfile's builder stage compiles the release binary and warms up the embedding model before tarring — memory/disk-heavy, and ACR Basic/Standard build agents reliably fail the model-tar layer after a ~25 min compile (confirmed twice). `integrations/cloud/README.md` now documents building with local Docker Desktop and `docker push` instead.
+
+### Fixed
+
+- **SCIP key-format 2.0 regression: simple-name extraction now strips parameters before segmenting.** Fully qualified symbol keys that carry parameter types (real C# methods do) segmented on the parameter list instead of the path segments, producing wrong simple names for the affected symbols.
+
 ## [1.4.11]
 
 ### Changed
@@ -334,6 +377,12 @@ finalized in place with a date — no renaming/migration step needed.
 ## [1.0.72] - 2026-05-01
 - Initial multi-repo release: multi-repo `serve` (HTTP/SSE, per-project/group routing, RRF cross-repo search), stdio MCP proxy with client-side auto-reconnect, tree-sitter chunking (9 langs), persistent SHA-256 embedding cache, repository groups, re-tuned RRF, and LMDB resize crash fix (#30, `MDB_MAP_FULL`).
 
+[1.5.2]: https://github.com/flupkede/codesearch/compare/v1.5.1...v1.5.2
+
+[1.5.1]: https://github.com/flupkede/codesearch/compare/v1.5.0...v1.5.1
+
+[1.5.0]: https://github.com/flupkede/codesearch/compare/v1.4.9...v1.5.0
+
 [1.4.9]: https://github.com/flupkede/codesearch/compare/v1.4.4...v1.4.9
 [1.0.171]: https://github.com/flupkede/codesearch/compare/v1.0.162...v1.0.171
 [1.0.162]: https://github.com/flupkede/codesearch/compare/v1.0.160...v1.0.162