@esankhan3/code-search-mcp 1.0.5 → 1.1.0

package/README.md

@@ -55,23 +55,38 @@ job — none of them need a separate install.
 code-search index .                                  # index current dir
 code-search query "where do we verify JWTs"          # hybrid by default
 code-search query "createPet" --mode bm25 --top-k 5  # exact-identifier mode
+code-search query --project petshop --format json "adopt pet"  # flags in any order
 code-search status --project petshop                 # JSON report
 code-search reset --project petshop                  # drop the index
 code-search --print-config                           # resolved config (redacted)
 ```
 Every `CodeSearchConfig` leaf is settable as `--<dotted-path>` —
 e.g. `--embedding.provider codestral`, `--retrieval.max-chunks 12`,
-`--no-indexing.auto-index`.
+`--no-indexing.auto-index`. An unknown flag (or an invalid `--mode` /
+`--format` / `--top-k`) exits with status 2 instead of being ignored.
+`query`, `status` and `--print-config` read the cwd's
+`.code-search.yaml`; `index <path>` reads the one in `<path>`.
+`status` reports where the KB lives (`dataDir`, `kbPath`), whether the
+project is indexed, and whether a daemon answers on its socket.
+`reset` only removes `<dataDir>/<project>` and rejects project names that
+aren't a single path segment (or are the reserved `daemon` / `projects`).
 
 ### Daemon mode (long-running indexer)
 ```sh
 code-search-daemon --workspace /path/to/repos
+code-search daemon --workspace .        # same, via the CLI wrapper
 ```
 Builds the index once, then watches the workspace and debounce-
-reindexes on file events. Listens on a UDS socket at
-`<dataDir>/daemon/<project>.sock` (named pipe on Windows). The CLI
-and MCP server automatically prefer the daemon when it's alive,
-falling back to in-process when it isn't.
+reindexes on file events (one index run per batch; results are fresh as
+soon as a run finishes). The project is named after the workspace
+directory. Listens on a UDS socket at `<dataDir>/daemon/<project>.sock`
+(named pipe on Windows) and writes `<project>.pid` next to it; a second
+daemon for the same project refuses to start, and a stopped daemon
+removes only its own socket + pid file. `code-search query` prefers the
+daemon when it answers a ping (`--no-daemon` to skip it), falling back
+to in-process when it doesn't. The MCP server (`--local` / `--serve`)
+does **not** use the daemon — it indexes and searches in-process, so
+don't run both on the same project.
 
 ### MCP — three modes (`code-search-mcp` argv)
 
@@ -96,19 +111,26 @@ your embedder + reranker are local (Ollama).
 
 **Serve**
 ```sh
-code-search-mcp --serve --port 4000 --auth api-key
+code-search-mcp --serve /path/to/repos --port 4000 --auth api-key
 ```
-Boots an HTTP server (Streamable HTTP transport, SSE optional)
-with `/mcp`, `/health`, `/ready`, `/version`, `/status`,
+Boots an HTTP server (Streamable HTTP on `/mcp`; there is no SSE
+transport) with `/health`, `/ready`, `/version`, `/status`,
 `/metrics` (Prometheus), `/admin/api/status`, and an admin
-`POST /index`. Use this to host one index for a whole team — every
-dev points their client at the same URL.
+`POST /index`. The port is bound before the startup index runs, so
+probes answer from the start (`/ready` is 503 until the index is
+servable). `--serve <path>`, `--serve --local <path>` and
+`--local <path> --serve` are equivalent; the project is `default`
+unless `--project` says otherwise. Use this to host one index for a
+whole team — every dev points their client at the same URL.
+
+`code-search mcp [path]` is the stdio local mode over the cwd (or
+`path`); `code-search mcp --remote URL` is the remote proxy.
 
 ---
 
 ## Tool surface
 
-Eleven tools across four categories. Every one of them maps to a
+Seventeen tools across four categories. Every one of them maps to a
 function in `@anvil/knowledge-core` — you're getting the same
 retrieval pipeline that powers the Anvil dashboard.
 
@@ -117,23 +139,28 @@ retrieval pipeline that powers the Anvil dashboard.
 |---|---|
 | `search_code` | Hybrid retrieval — vector + BM25 + graph + rerank |
 | `search_semantic` | Vector-only (paraphrases, intent) |
-| `search_exact` | BM25-only (identifiers, error codes) |
+| `search_exact` | BM25, led by exact symbol-name / phrase hits (identifiers, error codes); works without the embedder |
 | `get_code_snippet` | Fetch the source for one entity by qualified name (cheaper than reading the file) |
 
 ### Graph
 | Tool | What it does |
 |---|---|
-| `get_repo_graph` | Single-repo AST graph |
-| `get_cross_repo_edges` | Inter-repo edges (Kafka, HTTP, gRPC, shared types, …) |
-| `find_callers` | Who calls this function (exact by default; `fuzzy:true` for substring) |
-| `find_dependencies` | What this function calls |
-| `impact_analysis` | What breaks if this changes |
-| `trace_path` | Multi-hop call chain — shortest path between two functions, or the reachable call tree |
-| `search_graph` | Structural query — filter entities by name/type/file, ranked by connectivity |
-| `find_dead_code` | Entities with no callers (heuristic) |
-| `detect_changes` | Map a git diff to affected entities + their dependents |
+| `get_repo_graph` | Single-repo AST graph — entities and edges (`limit` caps each list) |
+| `get_cross_repo_edges` | Inter-repo edges (HTTP, gRPC, topics, tables, shared types, …), each with its evidence; same-repo workspace-package deps in their own section |
+| `find_callers` | Who calls this symbol — `calls` edges only by default; `relations` adds imports / uses / type-ref / inherits, listed per relation |
+| `find_dependencies` | What this symbol calls (same `relations` option) |
+| `impact_analysis` | What breaks if a file or entity changes — dependents up to `depth` hops (default 2, max 5), cross-repo included |
+| `trace_path` | Multi-hop call chain — shortest path (unweighted BFS) between two symbols, or what is reachable; `calls` edges by default |
+| `search_graph` | Structural query — filter nodes by name (regex over symbol names), type, file, repo; ranked by connectivity |
+| `find_dead_code` | Entities with no incoming edge and no other mention in their file (heuristic) |
+| `detect_changes` | Map a git diff to the entities whose lines changed (whole file for added / deleted files) + their dependents |
 | `get_architecture` | Project overview — repo roles, key flows, connections |
 
+Symbol arguments take a name (exact, case-sensitive) or a full
+`repo::file::entity` id; `fuzzy: true` matches a case-insensitive
+substring of symbol names. Every tool validates its arguments against
+its input schema — a bad argument returns `isError: true` and the reason.
+
 ### Profiles
 | Tool | What it does |
 |---|---|
@@ -143,7 +170,7 @@ retrieval pipeline that powers the Anvil dashboard.
 ### Index
 | Tool | What it does |
 |---|---|
-| `index_status` | Last indexed SHA, chunk count, embedding provider |
+| `index_status` | Chunk count, embedding provider, last indexed time, vector-index health, chunks per repo |
 
 Plus four MCP resources via `code-search://`:
 `repos`, `system-graph`, `repo/{name}/profile`, `repo/{name}/graph`.
@@ -178,8 +205,10 @@ exist between web and api?
 Fourteen cross-repo edge strategies cover shared types, Kafka,
 HTTP, gRPC, databases, env vars, npm/workspace deps, k8s,
 docker-compose, proto, Redis, S3, and shared constants. Plus an
-LLM-inferred semantic edge layer. `find_callers` works *across
-repos*. So does `impact_analysis`.
+LLM-inferred semantic edge layer. `get_cross_repo_edges`,
+`impact_analysis` and `detect_changes` work *across repos* (shared
+topics, tables and the like count as dependencies both ways);
+`find_callers` and `trace_path` do too with `relations: ["all"]`.
 
 ---
 
@@ -191,16 +220,17 @@ no scrape config or APM agent required.
 | Endpoint | Returns |
 |---|---|
 | `GET /health` | Liveness ping with project + uptime |
-| `GET /ready` | `200` only after first index completes |
-| `GET /version` | Package + Node + platform |
+| `GET /ready` | `200` once the index is servable, `503` before (incl. during the startup index) |
+| `GET /version` | Package version + Node + platform |
 | `GET /status` | Current indexing phase + last-success history |
-| `GET /metrics` | Prometheus text format (queries, latency histogram, chunks, embedding/LLM calls, errors) |
-| `GET /admin/api/status` | JSON status dashboard for the admin UI |
+| `GET /metrics` | Prometheus text format: queries, latency histogram, errors, seconds since the last successful index, chunks per repo, vector-index health |
+| `GET /admin/api/status` | JSON status dashboard for the admin UI (requires auth when auth is on) |
 
 Set `CODE_SEARCH_STRUCTURED_LOGS=1` for one-JSON-line-per-event
-stderr logs, and `CODE_SEARCH_TELEMETRY_RECORD_QUERIES=1` to opt
-into recording query text in spans (off by default — queries are
-PII-shaped).
+stderr logs from the server, daemon and CLI (lines knowledge-core
+prints itself stay plain), and `CODE_SEARCH_TELEMETRY_RECORD_QUERIES=1`
+to opt into recording query text in spans (off by default — queries
+are PII-shaped).
 
 ---
 
@@ -216,9 +246,15 @@ quotas:
   max_embedding_cost_usd: 5
 ```
 
-`ProjectRegistry` reads them at boot. `projectAccessAllowed`
-gates by scope (`*` is admin). `checkProjectQuota` enforces a
-sliding 1-minute window per `(identity, project)`.
+The HTTP server reads the entry of the project it serves once at
+boot and enforces it on every `/mcp` request: the caller's scopes
+must match `scopes` (`*` is admin; API keys are admin; a JWT's
+scopes come from its `scope` claim) or it gets 403, and
+`max_queries_per_minute` caps requests per `(identity, project)` in
+a sliding 1-minute window (429 + `Retry-After`). Not enforced:
+`repos`, `max_embedding_cost_usd` / `max_llm_cost_usd`, and any
+`config:` block (per-project config comes from the workspace's
+`.code-search.yaml`).
 
 ---
 
@@ -226,19 +262,25 @@ sliding 1-minute window per `(identity, project)`.
 
 ### Auth, three flavors
 `none` (local-only, default 127.0.0.1 binding), `api-key`
-(`Authorization: Bearer ...`, timing-safe compare), `jwt` (HS256,
-signature + `exp` + `iss` validated). Public binding without auth
-logs a warning, because that's what should happen.
+(`Authorization: Bearer ...`, timing-safe compare), `jwt` (HS256;
+signature, `iss`, a required `exp` and, when present, `nbf`
+validated; the server refuses to start in `jwt` mode without
+`CODE_SEARCH_AUTH_JWT_SECRET`). Public binding without auth logs a
+warning, because that's what should happen.
 
 ### Rate limiting
-In-memory sliding 1-minute window keyed by identity subject. Tune
-per-deployment.
+`CODE_SEARCH_RATE_LIMIT_PER_MINUTE` (default 100) requests per
+identity in a sliding 1-minute window (each API key counts on its
+own); 429 responses carry `Retry-After`. In cluster mode the limit
+applies to the whole server, not per worker.
 
 ### Auto-reindex
-`CODE_SEARCH_REINDEX_INTERVAL=30m` (or `1h`, `6h`, `0` to disable)
-runs an incremental re-index in the background. Skips itself if a
-manual index is already running. The timer is `unref`'d so it
-doesn't keep the process alive.
+`CODE_SEARCH_REINDEX_INTERVAL=30m` (or `1h`, `6h`, `0` to disable;
+also `indexing.reindex_interval_ms` in YAML or
+`--indexing.reindex-interval-ms`) runs an incremental re-index in
+the background. Anything else (e.g. `90s`) is reported as invalid and
+disables it. Skips itself if a manual index is already running. The
+timer is `unref`'d so it doesn't keep the process alive.
 
 ### Status tracking
 Every index call lands in a 50-entry FIFO history with start
@@ -252,9 +294,21 @@ instance: modern (2026-07-28) clients negotiate via
 per-request legacy fallback. No session map, no TTL.
 
 ### Admin index endpoint
-`POST /index` with `{ project, dirPath?, opts? }` triggers a
-fresh index. Gated against concurrent runs. Auth-required when
-auth is on.
+`POST /index` with `{ "path": "/repos", "force"?: true }` (re)indexes
+the served project from `path`, which then becomes its directory for
+scheduled reindexes. `project`, if given, must be the served project
+(a server never switches projects — 400 otherwise). Invalid JSON or a
+missing `path` → 400, a body over 64 KiB → 413, an index already
+running → 409. Auth-required when auth is on. The response reports
+chunks, repos and cross-repo edges.
+
+### Cluster mode
+`CODE_SEARCH_WORKERS=N` (2–16) forks N HTTP workers sharing the port.
+The primary is the only writer (startup index, `POST /index` forwarded
+over IPC, scheduled reindex) and pushes its indexing state to the
+workers, so `/status`, `/ready` and `/admin/api/status` look the same
+on every worker; rate limits and quotas are counted once for the whole
+server.
 
 ---
 
@@ -284,7 +338,8 @@ auth is on.
                     └────────────┬────────────┘
                                  │ on disk
                                  ▼
-                    ~/.anvil/knowledge-base/<project>/
+                    <dataDir>/<project>/
+                    (default ~/.anvil/knowledge-base/)
 ```
 
 Three different fronts, one knowledge stack:
@@ -314,16 +369,21 @@ Single resolver in `src/core/config.ts`. Five precedence layers
 5. CLI flags via `--<dotted-path>` (e.g. `--embedding.provider codestral`)
 
 Run `code-search --print-config` or `code-search-mcp --print-config`
-any time to see the resolved struct (secrets redacted).
+any time to see the resolved struct (secrets redacted — including
+passwords in URIs and OTEL header values). `--port`, `--host`,
+`--transport` and `--auth` are shorthands for `server.port`,
+`server.host`, `server.transport` and `auth.mode`.
 
 | Var (`CODE_SEARCH_*`) | Effect |
 |---|---|
 | `SERVER` | Remote URL (proxy mode) |
 | `API_KEY` | API key for proxy or serve modes |
-| `DATA_DIR` | Override the index storage root |
+| `DATA_DIR` | Index storage root (default `~/.anvil/knowledge-base`; also `storage.data_dir` / `--storage.data-dir`). Daemon sockets live under `<dataDir>/daemon/` |
 | `PORT` / `HOST` / `TRANSPORT` | HTTP server bind |
 | `AUTH_MODE` / `AUTH_API_KEYS` / `AUTH_JWT_SECRET` | Server auth |
-| `REINDEX_INTERVAL` | `30m` / `1h` / `6h` / `0` |
+| `REINDEX_INTERVAL` | `30m` / `1h` / `6h` / `0`; invalid → disabled |
+| `RATE_LIMIT_PER_MINUTE` | Per-identity request limit (sliding window) |
+| `WORKERS` | `>1` → cluster mode |
 | `EMBEDDING_PROVIDER` | `auto` / `codestral` / `voyage` / `openai` / `ollama` / `openai-compatible` / `custom` / `gemini-oauth` |
 | `EMBEDDING_MODEL` / `EMBEDDING_DIMENSIONS` | Model + dims |
 | `EMBEDDING_API_KEY` / `EMBEDDING_BASE_URL` | Credentials |
@@ -332,8 +392,8 @@ any time to see the resolved struct (secrets redacted).
 | `RERANKER_MODEL` / `RERANKER_API_KEY` / `RERANKER_BASE_URL` | Reranker config |
 | `RETRIEVAL_MAX_CHUNKS` / `RETRIEVAL_MAX_TOKENS` | Retrieval tuning |
 | `AUTO_INDEX` | `false` to disable startup auto-index |
-| `DAEMON_DISABLED` / `DAEMON_AUTO_SPAWN` | Daemon backend control |
-| `LLM_MODE` / `LLM_PROVIDER` / `LLM_MODEL` / `LLM_API_KEY` / `LLM_BASE_URL` | Profiling + service-mesh LLM. Pre-promoted to `ANVIL_LLM_*` so the agent-core integration is silent. |
+| `DAEMON_DISABLED` | `code-search query` never uses a daemon |
+| `LLM_MODE` / `LLM_PROVIDER` / `LLM_MODEL` / `LLM_API_KEY` / `LLM_BASE_URL` | Profiling + service-mesh LLM (`LLM_MODE` defaults to `none`). Pre-promoted to `ANVIL_LLM_*` so the agent-core integration is silent. |
 | `INDEXING_DEBOUNCE_MS` / `CHUNKING_MAX_TOKENS` | Indexer knobs |
 | `METRICS_ENABLED` / `STRUCTURED_LOGS` / `TELEMETRY_RECORD_QUERIES` | Observability |
 
@@ -381,8 +441,8 @@ proxies (cluster workers) are free.
 
 **Security defaults that don't bite.** Default bind is `127.0.0.1`
 when auth is `none`. API keys compared timing-safe. JWT
-signature + exp + iss validated. Public binding without auth
-logs a warning instead of pretending it's fine.
+signature + exp (required) + nbf + iss validated. Public binding
+without auth logs a warning instead of pretending it's fine.
 
 ---
 

package/dist/__tests__/_harness.js

@@ -0,0 +1,194 @@
+import { spawn, execFileSync } from "node:child_process";
+import { createServer } from "node:http";
+import { mkdirSync, mkdtempSync, realpathSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const DIST = fileURLToPath(new URL("..", import.meta.url));
+const BIN = {
+  mcp: join(DIST, "index.js"),
+  cli: join(DIST, "cli", "index.js"),
+  daemon: join(DIST, "daemon", "index.js")
+};
+function tmp(prefix = "cs-") {
+  return realpathSync(mkdtempSync(join(tmpdir(), prefix)));
+}
+async function startFakeEmbedder(port, opts = {}) {
+  const dims = opts.dims ?? 16;
+  let calls = 0;
+  const server = createServer((req, res) => {
+    let body = "";
+    req.on("data", (c) => {
+      body += c.toString();
+    });
+    req.on("end", () => {
+      calls++;
+      const input = (() => {
+        try {
+          return JSON.parse(body).input ?? [];
+        } catch {
+          return [];
+        }
+      })();
+      const data = input.map((text, index) => {
+        const v = new Array(dims).fill(0).map((_, i) => {
+          let h = 0;
+          for (let j = i; j < text.length; j += dims) h = (h * 31 + text.charCodeAt(j)) % 1e3;
+          return h / 1e3 + 1e-3;
+        });
+        return { object: "embedding", index, embedding: v };
+      });
+      setTimeout(() => {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ object: "list", data, model: "fake" }));
+      }, opts.delayMs ?? 0);
+    });
+  });
+  await new Promise((r) => server.listen(port, "127.0.0.1", () => r()));
+  return {
+    url: `http://127.0.0.1:${port}`,
+    calls: () => calls,
+    close: () => new Promise((r) => {
+      server.closeAllConnections();
+      server.close(() => r());
+    })
+  };
+}
+function makeRepo(root, name, files) {
+  const dir = join(root, name);
+  for (const [rel, content] of Object.entries(files)) {
+    mkdirSync(dirname(join(dir, rel)), { recursive: true });
+    writeFileSync(join(dir, rel), content);
+  }
+  const git = (...a) => execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", ...a], { cwd: dir, stdio: "pipe" });
+  git("init", "-q");
+  git("add", "-A");
+  git("commit", "-q", "-m", "init");
+  return dir;
+}
+function makeWorkspace(root) {
+  const ws = join(root, "ws");
+  makeRepo(ws, "orders", {
+    "package.json": '{"name":"orders","version":"1.0.0"}',
+    "src/orders.ts": [
+      "export const topic = 'orders.created';",
+      "export function createOrder(id: string) {",
+      '  return { id, status: "new" };',
+      "}",
+      "export function welcomeEmail(user: string) {",
+      "  return `welcome email for ${user}`;",
+      "}"
+    ].join("\n")
+  });
+  makeRepo(ws, "billing", {
+    "package.json": '{"name":"billing","version":"1.0.0"}',
+    "src/billing.ts": [
+      "const topic = 'orders.created';",
+      "export function chargeOrder(orderId: string, cents: number) {",
+      "  return { orderId, cents, charged: true };",
+      "}"
+    ].join("\n")
+  });
+  return ws;
+}
+function baseEnv(opts) {
+  const env = {};
+  for (const [k, v] of Object.entries(process.env)) {
+    if (/^(CODE_SEARCH_|ANVIL_|OPENAI_|ANTHROPIC_|MISTRAL_|VOYAGE_|COHERE_|OLLAMA_|OTEL_|GITHUB_TOKEN|CLAUDE_BIN)/.test(k)) continue;
+    env[k] = v;
+  }
+  env.HOME = opts.home;
+  env.CODE_SEARCH_LLM_MODE = "none";
+  env.CODE_SEARCH_RERANKER_PROVIDER = "none";
+  if (opts.dataDir) env.CODE_SEARCH_DATA_DIR = opts.dataDir;
+  if (opts.embedderUrl) {
+    env.CODE_SEARCH_EMBEDDING_PROVIDER = "custom";
+    env.CODE_SEARCH_EMBEDDING_BASE_URL = opts.embedderUrl;
+    env.CODE_SEARCH_EMBEDDING_MODEL = "fake";
+    env.CODE_SEARCH_EMBEDDING_DIMENSIONS = "16";
+  }
+  return { ...env, ...opts.extra };
+}
+function spawnProc(bin, args, env, cwd) {
+  const child = spawn(process.execPath, [bin, ...args], { env, cwd, stdio: ["pipe", "pipe", "pipe"] });
+  let out = "";
+  let err = "";
+  child.stdout.on("data", (d) => {
+    out += d.toString();
+  });
+  child.stderr.on("data", (d) => {
+    err += d.toString();
+  });
+  const exited = new Promise((r) => {
+    child.on("exit", (code, signal) => r({ code, signal }));
+  });
+  return {
+    child,
+    stdout: () => out,
+    stderr: () => err,
+    exited,
+    waitForStderr: (re, ms = 2e4) => waitFor(() => re.test(err), ms, `stderr ${re}
+--- stderr ---
+${err}`),
+    kill: () => {
+      try {
+        child.kill("SIGKILL");
+      } catch {
+      }
+    }
+  };
+}
+async function run(bin, args, env, cwd, timeoutMs = 6e4) {
+  const p = spawnProc(bin, args, env, cwd);
+  p.child.stdin.end();
+  const timer = setTimeout(() => p.kill(), timeoutMs);
+  const { code } = await p.exited;
+  clearTimeout(timer);
+  return { code, stdout: p.stdout(), stderr: p.stderr() };
+}
+async function waitFor(fn, ms = 2e4, what = "condition") {
+  const deadline = Date.now() + ms;
+  while (Date.now() < deadline) {
+    try {
+      if (await fn()) return;
+    } catch {
+    }
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  throw new Error(`timed out waiting for ${what}`);
+}
+async function exitWithin(p, ms) {
+  let timer;
+  const r = await Promise.race([
+    p.exited,
+    new Promise((res) => {
+      timer = setTimeout(() => res("timeout"), ms);
+    })
+  ]);
+  clearTimeout(timer);
+  if (r === "timeout") p.kill();
+  return r;
+}
+async function getJson(url, init) {
+  const res = await fetch(url, init);
+  const text = await res.text();
+  let body = text;
+  try {
+    body = JSON.parse(text);
+  } catch {
+  }
+  return { status: res.status, body, headers: res.headers };
+}
+export {
+  BIN,
+  baseEnv,
+  exitWithin,
+  getJson,
+  makeRepo,
+  makeWorkspace,
+  run,
+  spawnProc,
+  startFakeEmbedder,
+  tmp,
+  waitFor
+};

package/dist/__tests__/config-cli.test.js

@@ -0,0 +1,110 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parseCliFlags, resolveCodeSearchConfig, printConfig, DEFAULTS } from "../core/config.js";
+import { loadServerConfig, resetServerConfig } from "../core/env-config.js";
+import { validateProjectName } from "../core/project-name.js";
+const saved = { ...process.env };
+let noConfig;
+beforeEach(() => {
+  for (const k of Object.keys(process.env)) {
+    if (k.startsWith("CODE_SEARCH_") || k.startsWith("ANVIL_") || k === "OPENAI_API_KEY" || k === "ANTHROPIC_API_KEY") delete process.env[k];
+  }
+  const home = mkdtempSync(join(tmpdir(), "cs-cfg-"));
+  process.env.HOME = home;
+  noConfig = join(home, "none.yaml");
+  resetServerConfig();
+});
+afterEach(() => {
+  process.env = { ...saved };
+  resetServerConfig();
+});
+describe("parseCliFlags", () => {
+  it("maps the root aliases into the config tree (no junk top-level keys)", () => {
+    const { patch, unknown } = parseCliFlags(["--port", "3200", "--host", "0.0.0.0", "--auth", "jwt", "--transport", "streamable-http"]);
+    assert.deepEqual(unknown, []);
+    assert.equal(patch.server?.port, 3200);
+    assert.equal(patch.server?.host, "0.0.0.0");
+    assert.equal(patch.server?.transport, "streamable-http");
+    assert.equal(patch.auth?.mode, "jwt");
+    assert.equal(patch.port, void 0);
+  });
+  it("accepts dotted config paths and reports unknown ones", () => {
+    const ok = parseCliFlags(["--retrieval.max-chunks", "12", "--no-indexing.auto-index", "--storage.backends.blob.backend", "fs"]);
+    assert.deepEqual(ok.unknown, []);
+    assert.equal(ok.patch.retrieval?.maxChunks, 12);
+    assert.equal(ok.patch.indexing?.autoIndex, false);
+    const bad = parseCliFlags(["--retrieval.max-chunkz", "3", "--daemon.auto-spawn", "--language", "ts", "--config", "x.yaml"]);
+    assert.deepEqual(bad.unknown, ["--retrieval.max-chunkz", "--daemon.auto-spawn", "--language", "--config"]);
+  });
+});
+describe("--print-config redaction", () => {
+  it("redacts credentials in URIs, OTEL headers and secret-named keys", () => {
+    process.env.CODE_SEARCH_STORAGE_MONGO_URI = "mongodb://admin:PASSWORD1@db:27017/x";
+    process.env.CODE_SEARCH_STORAGE_MONGO_DB = "kb";
+    process.env.CODE_SEARCH_OTEL_HEADERS = "Authorization=Bearer OTELTOKEN,x-honeycomb-team=HONEYKEY";
+    process.env.CODE_SEARCH_EMBEDDING_BASE_URL = "https://user:URLPASS@embed.example.com/v1";
+    process.env.CODE_SEARCH_AUTH_JWT_SECRET = "JWTSECRET";
+    const cfg = resolveCodeSearchConfig({ configPath: noConfig });
+    cfg.storage.extra = { password: "PW2", clientSecret: "CS2", accessToken: "AT2", authorization: "Basic AU2" };
+    const out = printConfig(cfg);
+    for (const secret of ["PASSWORD1", "OTELTOKEN", "HONEYKEY", "URLPASS", "JWTSECRET", "PW2", "CS2", "AT2", "AU2"]) {
+      assert.ok(!out.includes(secret), `${secret} leaked:
+${out}`);
+    }
+    assert.match(out, /mongodb:\/\/admin:\*\*\*@db:27017\/x/);
+    assert.match(out, /https:\/\/user:\*\*\*@embed\.example\.com\/v1/);
+  });
+});
+describe("reindex interval", () => {
+  it("normalises env / CLI values the same way the server applies them", () => {
+    const at = (raw, cli = false) => {
+      delete process.env.CODE_SEARCH_REINDEX_INTERVAL;
+      if (!cli) process.env.CODE_SEARCH_REINDEX_INTERVAL = raw;
+      const patch = cli ? parseCliFlags(["--indexing.reindex-interval-ms", raw]).patch : void 0;
+      return resolveCodeSearchConfig({ configPath: noConfig, cli: patch }).indexing.reindexIntervalMs;
+    };
+    assert.equal(at("30m"), 30 * 6e4);
+    assert.equal(at("2h"), 2 * 36e5);
+    assert.equal(at("0"), 0);
+    assert.equal(at("none"), 0);
+    assert.equal(at("90s"), 0, "unsupported unit \u2192 disabled, not 90 ms");
+    assert.equal(at("abc"), 0);
+    assert.equal(at("30m", true), 30 * 6e4);
+    assert.equal(at("3600000", true), 36e5);
+    assert.equal(at("5", true), 0, "sub-minute interval \u2192 disabled");
+  });
+});
+describe("server config", () => {
+  it("honours an explicit LLM mode none even with an API key around", () => {
+    process.env.CODE_SEARCH_LLM_MODE = "none";
+    process.env.OPENAI_API_KEY = "sk-test";
+    assert.equal(loadServerConfig().llmMode, "none");
+  });
+  it("binds 0.0.0.0 by default when auth is enabled from any layer", () => {
+    const cfg = resolveCodeSearchConfig({ configPath: noConfig, cli: parseCliFlags(["--auth", "api-key"]).patch });
+    assert.equal(cfg.server.host, "0.0.0.0");
+    const explicit = resolveCodeSearchConfig({ configPath: noConfig, cli: parseCliFlags(["--auth", "api-key", "--host", "127.0.0.1"]).patch });
+    assert.equal(explicit.server.host, "127.0.0.1");
+    assert.equal(resolveCodeSearchConfig({ configPath: noConfig }).server.host, DEFAULTS.server.host);
+  });
+  it("applies the workspace .code-search.yaml layer", () => {
+    const ws = mkdtempSync(join(tmpdir(), "cs-ws-"));
+    writeFileSync(join(ws, ".code-search.yaml"), "retrieval:\n  max_chunks: 21\n");
+    try {
+      assert.equal(resolveCodeSearchConfig({ configPath: noConfig, workspaceDir: ws }).retrieval.maxChunks, 21);
+    } finally {
+      rmSync(ws, { recursive: true, force: true });
+    }
+  });
+});
+describe("validateProjectName", () => {
+  it("rejects names that would escape or collide inside the data dir", () => {
+    for (const bad of ["", ".", "..", "a/b", "..\\x", "daemon", "projects", "x\0y"]) {
+      assert.throws(() => validateProjectName(bad), /project name/i, JSON.stringify(bad));
+    }
+    for (const good of ["ws", "my-project", "org_1.2"]) validateProjectName(good);
+  });
+});

package/dist/__tests__/config-resolver.test.js

@@ -100,7 +100,7 @@ describe("toKnowledgeConfig (P3 adapter)", () => {
     const k = toKnowledgeConfig(cfg);
     assert.equal(k.embedding.provider, cfg.embedding.provider);
     assert.equal(k.retrieval.maxChunks, cfg.retrieval.maxChunks);
-    assert.deepEqual(k.chunking, cfg.indexing.chunking);
+    assert.deepEqual(k.chunking, { ...cfg.indexing.chunking, ignorePatterns: cfg.indexing.ignorePatterns });
     const r = typeof k.retrieval.reranker === "string" ? { provider: k.retrieval.reranker } : k.retrieval.reranker;
     assert.equal(r.provider, cfg.reranker.provider);
   });