sync: catch up fork to upstream develop v1.5.32 + harden the macOS dev loop

.cargo/config.toml

@@ -1,3 +1,9 @@
 [build]
 # Place target directory outside the repository to keep source tree clean
 target-dir = "../target"
+
+# Fast debug builds: rust-lld links several times faster than link.exe.
+# Debug-only policy (issue #192): release builds ship via release.yml and are
+# built there explicitly, never locally.
+[target.x86_64-pc-windows-msvc]
+linker = "rust-lld"

.github/workflows/bump-develop.yml

@@ -75,7 +75,7 @@ jobs:
           echo "new=$NEW" >> "$GITHUB_OUTPUT"
           echo "::notice::Bump $CURRENT -> $NEW"
 
-      - name: Bump version in Cargo.toml + Cargo.lock
+      - name: Bump version in Cargo.toml, Cargo.lock + scip-csharp.csproj
         env:
           CURRENT: ${{ steps.ver.outputs.current }}
           NEW: ${{ steps.ver.outputs.new }}
@@ -88,9 +88,15 @@ jobs:
           # dependency versions (unlike `cargo update --workspace`, which would
           # opportunistically bump transitive deps as a side effect).
           sed -i "/^name = \"codesearch\"/,/^version = /{ s/^version = \"$CURRENT\"/version = \"$NEW\"/ }" Cargo.lock
-          # Hard-verify both files now carry the new version before committing.
+          # scip-csharp.csproj — the helper's <Version> feeds its --version line,
+          # the same-build identity the host logs and copy-to-common compares.
+          # Rewrite WHATEVER value is there, never anchor on $CURRENT: once the
+          # files drift apart the substitution silently no-ops forever.
+          sed -i "0,/<Version>[^<]*<\/Version>/s//<Version>$NEW<\/Version>/" helpers/csharp/scip-csharp.csproj
+          # Hard-verify all three files now carry the new version before committing.
           grep -m1 "^version = \"$NEW\"" Cargo.toml >/dev/null
           grep -A1 '^name = "codesearch"$' Cargo.lock | grep -m1 "^version = \"$NEW\"" >/dev/null
+          grep -m1 "<Version>$NEW</Version>" helpers/csharp/scip-csharp.csproj >/dev/null
 
       - name: Commit & push bump
         env:
@@ -100,7 +106,7 @@ jobs:
           set -euo pipefail
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add Cargo.toml Cargo.lock
+          git add Cargo.toml Cargo.lock helpers/csharp/scip-csharp.csproj
           # No-op guard (e.g. a re-merge that already left develop at NEW).
           if git diff --cached --quiet; then
             echo "No version change to commit (already at $NEW)."

.github/workflows/ci.yml

@@ -111,6 +111,17 @@ jobs:
         if: steps.changed.outputs.relevant == 'true'
         with:
           dotnet-version: '10.0.x'
+      # The xunit suite (models, key format, workspace/restore policy and the
+      # Blazor generator integration pin) must run in CI: until now only the
+      # cargo integration tests ran here, so a helper regression the xunit
+      # suite pins stayed green all the way to develop. Runs BEFORE the
+      # expensive publish + cargo cycle so a helper failure fails fast.
+      # NO MSBuild flags on dotnet test — the test SDK answers "Zero tests
+      # ran" (exit 5) with them, a false negative that survives a clean
+      # rebuild (repo convention).
+      - name: Run scip-csharp xunit suite
+        if: steps.changed.outputs.relevant == 'true'
+        run: dotnet test helpers/csharp/tests/ScipCsharp.Tests.csproj
       - name: Build scip-csharp helper (self-contained single-file)
         if: steps.changed.outputs.relevant == 'true'
         run: |

.github/workflows/release.yml

@@ -126,14 +126,14 @@ jobs:
 
       - name: Upload kale artifact
         # pin@v4
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: ${{ matrix.artifact }}
           path: ${{ matrix.artifact }}
 
       - name: Upload with-csharp artifact
         # pin@v4
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: ${{ matrix.artifact_csharp }}
           path: ${{ matrix.artifact_csharp }}
@@ -232,14 +232,14 @@ jobs:
 
       - name: Upload kale artifact
         # pin@v4
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: codesearch-macos-arm64.tar.gz
           path: codesearch-macos-arm64.tar.gz
 
       - name: Upload with-csharp artifact
         # pin@v4
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: codesearch-macos-arm64-with-csharp.tar.gz
           path: codesearch-macos-arm64-with-csharp.tar.gz
@@ -253,7 +253,7 @@ jobs:
     steps:
       - name: Download all artifacts
         # pin@v4
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333
         with:
           path: artifacts
           merge-multiple: true

AGENTS.develop.md

@@ -187,7 +187,7 @@ TUI `i` overlay. The TUI discovery tick is config-only (zero HTTP).
 ## Runtime locations
 
 - **Runtime dir**: `C:\Users\develterf\.local\bin\` — contains `codesearch.exe` and `helpers/csharp/scip-csharp.exe`. This is where `codesearch serve` runs from.
-- **Build:** via `build.ps1` (repo root) — it self-heals the bare-flag quirk and sets `CARGO_TARGET_DIR` so `target/` stays outside the repo.
+- **Build:** via `build.ps1` (repo root) — it self-heals the bare-flag quirk and sets `CARGO_TARGET_DIR` so `target/` stays outside the repo. Debug-only (issue #192): `-Release` is refused, release artifacts come from CI; rust-lld is pinned in `.cargo/config.toml` (bin rebuild ~2x faster).
 - **Build dir**: `target/release/` — lives **outside the repo** (set via `CARGO_TARGET_DIR`). For compilation only. Never run codesearch from this location.
 - **Logs**: `~\.codesearch\logs\` — codesearch writes structured logs here during serve. Check these for startup errors, rebuild failures, and helper detection messages.
 
@@ -200,6 +200,7 @@ TUI `i` overlay. The TUI discovery tick is config-only (zero HTTP).
 
 ## Notes for agents
 
+- **Before direct git work in this checkout, force `git config core.bare false`.** This repo is a bare+working-tree hybrid (`codesearch.git` holds a full checkout) and VS Code's git integration intermittently resets `core.bare` to `true` on ref changes, breaking every git operation outside `build.ps1`/`copy-to-common.ps1` (both self-heal it before building). Symptom: "fatal: this operation must be run in a work tree" from an otherwise intact checkout.
 - **Never use the bundled `codesearch` binary to investigate this repo** (it is the project under development). Use codesearch MCP tools first for discovery (this repo is indexed as `codesearch-git`); `grep`/`Read` for exact refs, other git refs, or when MCP returns nothing.
 - **Tests live in sibling `_tests.rs` files**, table-driven preferred over near-duplicate per-case fns.
 - **Tests that set env vars must be `#[serial]`** and set them via `crate::testing::EnvRestore` — cargo runs tests as parallel threads of one process, so an unserialised `set_var` races every reader.
@@ -235,12 +236,20 @@ Never `unwrap_or_default()` a store error on a search path — "no results" and
 
 | Branch | Description |
 |---|---|
-| *(none)* | |
 
 ---
 
 ## Changelog highlights (recent)
 
+- **v1.5.31 (pending)** — scip-csharp VS-MSBuild restore fallback: NETSDK1045-class CLI SDK gaps (hollow SDK dir, net10-only-in-VS) retry via vswhere + `MSBuild -t:restore`, and MSBuild registration picks a VS instance when no CLI SDK can target the repo
+- **v1.5.31 (pending)** — serve TUI status: `Indexing` only for real text indexing (pure SCIP rebuilds drive the C#/TS columns only); resting repos read `Idle` again
+- **v1.5.16 (pending)** — C# restore-pending retries 20×60s → 3 attempts with exponential backoff; restore exhaustion renders as yellow C#⚠ partial on every serve path instead of a red error
+- **v1.5.6 (pending)** — scip-csharp demotes MSBuild check advisories + BuildHost shutdown chatter from index warnings
+- **v1.5.15 (pending)** — CLI add/reindex refuse to build locally when the serve reports the alias already indexing (409 two-writer case); other delegation failures keep the local fallback
+- **v1.5.14 (pending)** — db dir marked hidden on Windows: the Search indexer no longer crawls `.codesearch.db` (structural fix for the scanner race on fresh Tantivy segments)
+- **v1.5.13 (pending)** — symbol-index status (ready/stale/degraded/absent) on REST info, both TUIs and every find_impact answer; vanishing-repo fix: transient FTS commit race gets one full-pass retry and failed first builds keep the repo registered
+- **v1.5.5** — serve TUI: symbol-index warnings wrap instead of clipping and `c` copies them to the clipboard
+- **v1.5.4** — restore gate: CPM-aware restore freshness (Directory.Packages.props etc.), restore-pending exit 75 with host-side bounded retry, previous index stays live during restore, watcher fires full C# rebuild on restore-input changes
 - **v1.4.4** — resident C# workspace pool no longer serves stale `find_impact` results after a rebuild: `WorkspacePool::evict` bumps a per-solution generation counter closing a spawn-in-flight race, and `scip_ref_cache` is now cleared unconditionally on both full and incremental rebuilds
 - **v1.3.37** — per-index embedding models end-to-end: serve queries, `POST /repos` and CLI index/stats/status honour the model each index records in its `metadata.json`; `serve --model` sets the default for newly created indexes; unrecorded indexes are queried with the built-in model plus a caller-facing warning; mid-rebuild indexes no longer report ready (PR #248)
 - **v1.3.23–v1.3.36** — dependency + platform wave: rmcp 3.3, fastembed 6.1 + ort rc.13, tantivy 0.26, axum 0.8, ratatui 0.30 + crossterm 0.29, thiserror 2, notify 8, tree-sitter 0.27, dirs/sha2/scip/sysinfo refresh + dependabot (weekly); clears the open Aikido/RUSTSEC advisories