fix: harden runtime and accelerate indexing

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
 on:
+  workflow_dispatch:
   push:
     branches: [main]
   pull_request:
@@ -21,3 +22,20 @@ jobs:
       # The committed bundle (engine.mjs + engine.d.mts + grammars) must be
       # byte-reproducible from source — consumers vendor those exact bytes.
       - run: pnpm run check:build
+
+  smoke-node18:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 18
+      # The published artifacts are committed and dependency-free. Exercise
+      # those directly: the dev toolchain intentionally requires newer Node.
+      - name: Import library and run CLI on Node 18
+        run: |
+          node -e 'import("./scripts/engine.mjs").then(m => { if (typeof m.scanRepo !== "function") process.exit(1) })'
+          node scripts/cli.mjs scan --repo tests/fixtures/mini-repo --out /tmp/codeindex-node18-scan.json
+          node scripts/cli.mjs search client --repo tests/fixtures/mini-repo --out /tmp/codeindex-node18-search.json
+          test -s /tmp/codeindex-node18-scan.json
+          test -s /tmp/codeindex-node18-search.json

.github/workflows/grammars-repin.yml

@@ -11,21 +11,20 @@ name: Grammars repin
 # bundle (`pnpm build` — web-tree-sitter's JS is inlined into engine.mjs by
 # tsup, so its wasm and its bundled runtime move together), then runs the full
 # gate (typecheck / test / reproducible-bundle). Only if every gate is green AND
-# something actually changed does it push the result straight to `main`. On any
-# failure the run simply goes red and the next cron retries — no branch, no PR.
-#
-# GITHUB_TOKEN is enough here: it can push to this repo, and GitHub's
-# anti-recursion rule means that push does NOT re-trigger CI/release workflows
-# (the gate already ran in this job before the push), so a grammar bump never
-# accidentally cuts a release.
+# something actually changed does it update a dedicated pull request. Grammar
+# bytes are part of the engine's versioned output: merging the `fix(grammars)`
+# commit therefore cuts a patch release and publishes a matching grammar asset,
+# instead of silently changing wasm under an existing ENGINE_VERSION.
 
 on:
   workflow_dispatch:
   schedule:
     - cron: "41 3 * * *" # daily, 03:41 UTC (offset from other repos' crons)
 
 permissions:
+  actions: write
   contents: write
+  pull-requests: write
 
 jobs:
   repin:
@@ -55,7 +54,7 @@ jobs:
       - name: Stop if nothing changed
         id: diff
         run: |
-          if git diff --quiet -- package.json pnpm-lock.yaml scripts/engine.mjs scripts/engine.d.mts scripts/cli.mjs scripts/grammars; then
+          if git diff --quiet -- package.json pnpm-lock.yaml scripts/engine.mjs scripts/engine.d.mts scripts/engine.browser.mjs scripts/engine.browser.d.mts scripts/cli.mjs scripts/grammars; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "Grammars already up to date — nothing to re-pin."
           else
@@ -68,13 +67,14 @@ jobs:
           pnpm run typecheck
           pnpm test
 
-      - name: Commit re-pinned grammars
+      - name: Commit re-pinned grammars on the automation branch
         if: steps.diff.outputs.changed == 'true'
         run: |
+          git switch -c automation/grammars-repin
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add package.json pnpm-lock.yaml scripts/engine.mjs scripts/engine.d.mts scripts/cli.mjs scripts/grammars
-          git commit -m "chore(grammars): bump tree-sitter grammars to latest and re-vendor wasm"
+          git add package.json pnpm-lock.yaml scripts/engine.mjs scripts/engine.d.mts scripts/engine.browser.mjs scripts/engine.browser.d.mts scripts/cli.mjs scripts/grammars
+          git commit -m "fix(grammars): bump tree-sitter grammars and re-vendor wasm"
 
       # Reproducible-bundle gate LAST, against the just-committed tree: it rebuilds
       # and `git diff --exit-code`s, proving the committed bytes are what source
@@ -84,6 +84,30 @@ jobs:
         if: steps.diff.outputs.changed == 'true'
         run: pnpm run check:build
 
-      - name: Push to main
+      - name: Push automation branch and open or refresh the pull request
         if: steps.diff.outputs.changed == 'true'
-        run: git push
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          REMOTE_SHA=$(git ls-remote --heads origin refs/heads/automation/grammars-repin | cut -f1)
+          if [ -n "$REMOTE_SHA" ]; then
+            git push "--force-with-lease=refs/heads/automation/grammars-repin:$REMOTE_SHA" origin HEAD:refs/heads/automation/grammars-repin
+          else
+            git push origin HEAD:refs/heads/automation/grammars-repin
+          fi
+          PR=$(gh pr list --head automation/grammars-repin --state open --json number --jq '.[0].number // empty')
+          if [ -n "$PR" ]; then
+            gh pr edit "$PR" \
+              --title "fix(grammars): bump tree-sitter grammars and re-vendor wasm" \
+              --body "Automated grammar repin. The full test and reproducible-build gates passed; merging creates a patch release so ENGINE_VERSION and the downloadable grammar asset remain aligned."
+          else
+            gh pr create \
+              --base main \
+              --head automation/grammars-repin \
+              --title "fix(grammars): bump tree-sitter grammars and re-vendor wasm" \
+              --body "Automated grammar repin. The full test and reproducible-build gates passed; merging creates a patch release so ENGINE_VERSION and the downloadable grammar asset remain aligned."
+          fi
+          # GITHUB_TOKEN-created PR events do not recursively start CI. An
+          # explicit workflow_dispatch is allowed and attaches the normal CI
+          # checks (including Node 18 smoke) to this branch's HEAD.
+          gh workflow run ci.yml --ref automation/grammars-repin

.gitignore

@@ -7,6 +7,7 @@ tests/.e2e-cache/
 scripts/embed-asset/model.json
 scripts/embed-asset/.venv/
 .codeindex/
+.codeindex-edit-*/
 
 # The EXTENDED tree-sitter grammar tier lives only in the GitHub release asset,
 # never in git: `node scripts/fetch-grammars.mjs --extended` regenerates it, and

README.md

@@ -716,6 +716,14 @@ codeindex mcp --repo /path/to/workspace
 An explicit per-call `repo` still wins, so a pinned server can still answer
 about another checkout. `--server-name <name>` overrides the announced
 `serverInfo.name` for hosts that embed the server under their own identity.
+Add `--watch` to a pinned server for proactive recursive filesystem
+invalidation. Every request still verifies freshness with the normal stat walk
+because a request can arrive before its filesystem event; the watcher is a hint,
+not a correctness oracle. Directories excluded by the scanner (`.git`, build
+outputs, dependency caches, `.codeindex`, edit temporaries, etc.) are ignored by
+the watcher too. Git commit metadata is still refreshed by the per-request
+check. When the platform cannot provide recursive watching, the server warns
+and continues with those normal freshness scans.
 
 **Prime the index first** and activation becomes a load, not a rebuild:
 `codeindex index --repo <dir> --out <dir>/.codeindex`. The first tool call

package.json

@@ -70,9 +70,9 @@
     "@tree-sitter-grammars/tree-sitter-kotlin": "1.1.0",
     "@tree-sitter-grammars/tree-sitter-lua": "0.4.1",
     "@tree-sitter-grammars/tree-sitter-zig": "1.1.2",
-    "@types/node": "^20.14.0",
-    "esbuild": "0.28.1",
-    "semantic-release": "^25.0.8",
+    "@types/node": "^20.19.43",
+    "esbuild": "0.28.2",
+    "semantic-release": "^25.0.9",
     "tree-sitter-bash": "0.25.1",
     "tree-sitter-c": "^0.24.1",
     "tree-sitter-c-sharp": "^0.23.5",
@@ -90,10 +90,13 @@
     "tree-sitter-typescript": "^0.23.2",
     "tsup": "^8.3.0",
     "typescript": "^5.5.0",
-    "vitest": "^4.1.0",
+    "vitest": "^4.1.11",
     "web-tree-sitter": "^0.26.13"
   },
   "pnpm": {
+    "overrides": {
+      "esbuild": "0.28.2"
+    },
     "onlyBuiltDependencies": [
       "esbuild"
     ]