create-interview-cockpit 0.24.0 → 0.26.0

package/template/server/src/index.ts

@@ -17,6 +17,7 @@ import {
   tool,
   stepCountIs,
   type LanguageModel,
+  type ToolSet,
 } from "ai";
 import { z } from "zod";
 import { createOpenAI } from "@ai-sdk/openai";
@@ -163,6 +164,7 @@ function makeCodeReferenceFileEntry(
 }
 
 interface GitDiffContextPayload {
+  rootId?: string;
   baseRef?: string;
   headRef?: string;
   mode?: string;
@@ -176,82 +178,56 @@ async function registerGitDiffContext(
   fileRegistry: Map<string, ReferenceFileEntry>,
   ctx: GitDiffContextPayload,
 ): Promise<string> {
-  if (!GIT_DIFF_DIR) return "";
-  const base = (ctx.baseRef || "").trim();
-  if (!base || !isValidRef(base)) return "";
-  const mode = parseDiffMode(ctx.mode);
-  const headRaw = (ctx.headRef || "").trim();
-  const head = mode === "working-tree" ? WORKING_TREE_SENTINEL : headRaw;
-  if (mode !== "working-tree" && (!head || !isValidRef(head))) return "";
-
-  const selected = Array.isArray(ctx.selectedFiles)
-    ? ctx.selectedFiles.filter(
-        (p) => typeof p === "string" && p && !p.includes("\0"),
-      )
-    : [];
-  if (selected.length === 0) return "";
+  const scoped = await getScopedGitDiffContext(ctx);
+  if (!scoped) return "";
+  const { root, base, head, mode, entries, rangeLabel, headLabel } = scoped;
 
-  let changedFiles: GitDiffFileEntry[];
-  try {
-    changedFiles = await getChangedFiles(base, head, mode);
-  } catch {
-    return "";
-  }
-  const byPath = new Map(changedFiles.map((f) => [f.path, f]));
-  const validSelected = selected.filter((p) => byPath.has(p));
-  if (validSelected.length === 0) return "";
-
-  const headLabel = mode === "working-tree" ? "working tree" : head;
-  const rangeLabel =
-    mode === "working-tree"
-      ? `${base} → working tree`
-      : `${base} ${mode === "two-dot" ? ".." : "..."} ${headLabel}`;
-
-  let manifest = `\n\n--- Available Git Diff Context (${rangeLabel}) ---
-You can pull lazy git diff context with the readFile tool. Three views are available per file:
-  • gitdiff:patch:<path>   — unified diff hunks (recommended starting point)
-  • gitdiff:before:<path>  — full file contents at the base ref
-  • gitdiff:after:<path>   — full file contents at the head ref (or working tree)
-Only read what you need; each file can be expensive.
+  let manifest = `\n\n--- Available Git Diff Context (${root.name}: ${rangeLabel}) ---
+You can inspect the selected changed files with the Git Diff tools or pull lazy views with readFile. Three views are available per file:
+  • gitdiff:patch:<root>::<path>   — unified diff hunks (recommended starting point)
+  • gitdiff:before:<root>::<path>  — full file contents at the base ref
+  • gitdiff:after:<root>::<path>   — full file contents at the head ref (or working tree)
+Use listGitDiffFiles to see selected diff files, readGitDiffFile to get patch/before/after, searchGitDiff to find specific changes, and summarizeGitDiff for totals. Only read what you need; each file can be expensive.
 
 `;
-  for (const filePath of validSelected) {
-    const entry = byPath.get(filePath)!;
+  for (const entry of entries) {
     const sign = entry.binary
       ? "binary"
       : `+${entry.additions}/-${entry.deletions}`;
     const renamed = entry.oldPath ? `  (renamed from ${entry.oldPath})` : "";
-    manifest += `• [${entry.status}] ${entry.path}  ${sign}${renamed}\n`;
-    manifest += `    patch id: "gitdiff:patch:${entry.path}"\n`;
+    manifest += `• [${entry.status}] ${entry.displayPath}  ${sign}${renamed}\n`;
+    manifest += `    patch id: "gitdiff:patch:${entry.id}"\n`;
     if (entry.status !== "A" && entry.status !== "?") {
-      manifest += `    before id: "gitdiff:before:${entry.path}"\n`;
+      manifest += `    before id: "gitdiff:before:${entry.id}"\n`;
     }
     if (entry.status !== "D") {
-      manifest += `    after id:  "gitdiff:after:${entry.path}"\n`;
+      manifest += `    after id:  "gitdiff:after:${entry.id}"\n`;
     }
 
-    const safePath = filePath; // already validated to be in diff
+    const safePath = entry.path; // already validated to be in diff
     fileRegistry.set(
-      `gitdiff:patch:${safePath}`,
-      makeCodeReferenceFileEntry(`[git diff] ${safePath}`, () =>
-        getDiffPatch(base, head, mode, safePath),
+      `gitdiff:patch:${entry.id}`,
+      makeCodeReferenceFileEntry(`[git diff:${root.name}] ${safePath}`, () =>
+        getDiffPatch(root, base, head, mode, safePath),
       ),
     );
     if (entry.status !== "A" && entry.status !== "?") {
       const refPath = entry.oldPath ?? safePath;
       fileRegistry.set(
-        `gitdiff:before:${safePath}`,
-        makeCodeReferenceFileEntry(`[git before ${base}] ${safePath}`, () =>
-          getFileAtRef(base, refPath),
+        `gitdiff:before:${entry.id}`,
+        makeCodeReferenceFileEntry(
+          `[git before ${base}:${root.name}] ${safePath}`,
+          () => getFileAtRef(root, base, refPath),
         ),
       );
     }
     if (entry.status !== "D") {
       const ref = mode === "working-tree" ? WORKING_TREE_SENTINEL : head;
       fileRegistry.set(
-        `gitdiff:after:${safePath}`,
-        makeCodeReferenceFileEntry(`[git after ${headLabel}] ${safePath}`, () =>
-          getFileAtRef(ref, safePath),
+        `gitdiff:after:${entry.id}`,
+        makeCodeReferenceFileEntry(
+          `[git after ${headLabel}:${root.name}] ${safePath}`,
+          () => getFileAtRef(root, ref, safePath),
         ),
       );
     }
@@ -343,7 +319,1235 @@ function createReadFileTool(fileRegistry: Map<string, ReferenceFileEntry>) {
 }
 
 const PORT = process.env.PORT || 3001;
-const CODE_CONTEXT_DIR = process.env.CODE_CONTEXT_DIR || "";
+const CODE_CONTEXT_ROOT_SEPARATOR = "::";
+
+interface CodeContextRootConfig {
+  id: string;
+  name: string;
+  dir: string;
+}
+
+interface CodeContextFileRef {
+  id: string;
+  root: CodeContextRootConfig;
+  relPath: string;
+  absolutePath: string;
+}
+
+function splitCodeContextRootEnv(value: string | undefined): string[] {
+  if (!value) return [];
+  return value
+    .split(/[\n,;]/)
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+function parseCodeContextRootSpec(
+  raw: string,
+): { name?: string; dir: string } | null {
+  const value = raw.trim();
+  if (!value) return null;
+  const eq = value.indexOf("=");
+  if (eq > 0) {
+    const maybeName = value.slice(0, eq).trim();
+    const maybeDir = value.slice(eq + 1).trim();
+    if (maybeName && maybeDir && !/[\\/]/.test(maybeName)) {
+      return { name: maybeName, dir: path.resolve(maybeDir) };
+    }
+  }
+  return { dir: path.resolve(value) };
+}
+
+function slugForCodeContextRoot(value: string): string {
+  return (
+    value
+      .toLowerCase()
+      .replace(/[^a-z0-9._-]+/g, "-")
+      .replace(/^-+|-+$/g, "") || "root"
+  );
+}
+
+function uniqueCodeContextRootName(
+  baseName: string,
+  usedNames: Map<string, number>,
+): string {
+  const clean = baseName.trim() || "Code Context";
+  const key = clean.toLowerCase();
+  const count = usedNames.get(key) ?? 0;
+  usedNames.set(key, count + 1);
+  return count === 0 ? clean : `${clean} (${count + 1})`;
+}
+
+function uniqueCodeContextRootId(baseId: string, usedIds: Set<string>): string {
+  let candidate = baseId;
+  let suffix = 2;
+  while (usedIds.has(candidate)) {
+    candidate = `${baseId}-${suffix}`;
+    suffix += 1;
+  }
+  usedIds.add(candidate);
+  return candidate;
+}
+
+function resolveCodeContextRoots(): CodeContextRootConfig[] {
+  const specs = [
+    ...(process.env.CODE_CONTEXT_DIR
+      ? [
+          process.env.CODE_CONTEXT_NAME
+            ? `${process.env.CODE_CONTEXT_NAME}=${process.env.CODE_CONTEXT_DIR}`
+            : process.env.CODE_CONTEXT_DIR,
+        ]
+      : []),
+    ...splitCodeContextRootEnv(process.env.CODE_CONTEXT_DIRS),
+  ];
+  const seenDirs = new Set<string>();
+  const usedNames = new Map<string, number>();
+  const usedIds = new Set<string>();
+  const roots: CodeContextRootConfig[] = [];
+
+  for (const spec of specs) {
+    const parsed = parseCodeContextRootSpec(spec);
+    if (!parsed) continue;
+    const dir = path.resolve(parsed.dir);
+    if (seenDirs.has(dir)) continue;
+    seenDirs.add(dir);
+    const fallbackName = path.basename(dir) || "Code Context";
+    const name = uniqueCodeContextRootName(
+      parsed.name || fallbackName,
+      usedNames,
+    );
+    const id = uniqueCodeContextRootId(slugForCodeContextRoot(name), usedIds);
+    roots.push({ id, name, dir });
+  }
+
+  return roots;
+}
+
+const CODE_CONTEXT_ROOTS = resolveCodeContextRoots();
+const CODE_CONTEXT_ROOT_BY_ID = new Map(
+  CODE_CONTEXT_ROOTS.map((root) => [root.id, root]),
+);
+// Backward-compatible primary root used by git-diff config when GIT_DIFF_DIR is unset.
+const CODE_CONTEXT_DIR = CODE_CONTEXT_ROOTS[0]?.dir ?? "";
+
+function makeCodeContextFileId(rootId: string, relPath: string): string {
+  return `${rootId}${CODE_CONTEXT_ROOT_SEPARATOR}${relPath}`;
+}
+
+function getCodeContextPrimaryRoot(): CodeContextRootConfig | null {
+  return CODE_CONTEXT_ROOTS[0] ?? null;
+}
+
+const MAX_CODE_TOOL_LIST_RESULTS = 400;
+const MAX_CODE_TOOL_SEARCH_RESULTS = 80;
+const MAX_CODE_TOOL_SEARCH_FILE_BYTES = 512 * 1024;
+const MAX_CODE_TOOL_READ_BYTES = 256 * 1024;
+const MAX_CODE_TOOL_CONTEXT_LINES = 5;
+const MAX_CODE_TOOL_LINE_CHARS = 600;
+
+function normalizeCodeContextRelPath(value: string): string | null {
+  const raw = value.replaceAll("\\", "/").trim();
+  if (!raw || raw.includes("\0") || path.isAbsolute(raw)) return null;
+  const normalized = path.posix.normalize(raw.replace(/^\.\//, ""));
+  if (!normalized || normalized === ".") return null;
+  if (normalized === ".." || normalized.startsWith("../")) return null;
+  return normalized;
+}
+
+function getCodeContextFileRef(
+  fileIdOrPath: string,
+): CodeContextFileRef | null {
+  if (CODE_CONTEXT_ROOTS.length === 0) return null;
+  const raw = fileIdOrPath.replaceAll("\\", "/").trim();
+  if (!raw || raw.includes("\0")) return null;
+
+  const sepIdx = raw.indexOf(CODE_CONTEXT_ROOT_SEPARATOR);
+  const root =
+    sepIdx > 0
+      ? CODE_CONTEXT_ROOT_BY_ID.get(raw.slice(0, sepIdx))
+      : getCodeContextPrimaryRoot();
+  const relRaw =
+    sepIdx > 0 ? raw.slice(sepIdx + CODE_CONTEXT_ROOT_SEPARATOR.length) : raw;
+  if (!root) return null;
+
+  const normalized = normalizeCodeContextRelPath(relRaw);
+  if (!normalized || !isCodeContextPathAllowed(normalized)) return null;
+
+  const rootDir = path.resolve(root.dir);
+  const resolved = path.resolve(rootDir, normalized);
+  const relativeToRoot = path.relative(rootDir, resolved);
+  if (relativeToRoot.startsWith("..") || path.isAbsolute(relativeToRoot)) {
+    return null;
+  }
+  return {
+    id: makeCodeContextFileId(root.id, normalized),
+    root,
+    relPath: normalized,
+    absolutePath: resolved,
+  };
+}
+
+function resolveCodeContextFilePath(fileIdOrPath: string): string | null {
+  return getCodeContextFileRef(fileIdOrPath)?.absolutePath ?? null;
+}
+
+function codeContextRelPath(fileIdOrPath: string): string {
+  return getCodeContextFileRef(fileIdOrPath)?.relPath ?? fileIdOrPath;
+}
+
+function codeContextDisplayPath(fileIdOrPath: string): string {
+  const ref = getCodeContextFileRef(fileIdOrPath);
+  if (!ref) return fileIdOrPath;
+  return `${ref.root.name}/${ref.relPath}`;
+}
+
+function codeContextFilterText(fileIdOrPath: string): string {
+  const ref = getCodeContextFileRef(fileIdOrPath);
+  if (!ref) return fileIdOrPath;
+  return `${ref.id} ${ref.root.name} ${ref.relPath}`;
+}
+
+async function getVisibleFilesForCodeContextRoot(
+  root: CodeContextRootConfig,
+): Promise<Set<string>> {
+  try {
+    return new Set(await walkDir(root.dir));
+  } catch {
+    return new Set();
+  }
+}
+
+async function getCodeContextRootsTree() {
+  const roots = [];
+  for (const root of CODE_CONTEXT_ROOTS) {
+    const files = [...(await getVisibleFilesForCodeContextRoot(root))].sort(
+      (a, b) => a.localeCompare(b),
+    );
+    roots.push({ id: root.id, name: root.name, files });
+  }
+  return { roots };
+}
+
+async function getScopedCodeContextFiles(
+  selectedFiles: unknown,
+): Promise<string[]> {
+  if (CODE_CONTEXT_ROOTS.length === 0 || !Array.isArray(selectedFiles)) {
+    return [];
+  }
+
+  const selected = selectedFiles
+    .filter((file): file is string => typeof file === "string")
+    .map((file) => getCodeContextFileRef(file))
+    .filter((file): file is CodeContextFileRef => Boolean(file));
+
+  if (selected.length === 0) return [];
+
+  const visibleByRoot = new Map<string, Set<string>>();
+  for (const root of CODE_CONTEXT_ROOTS.filter((root) =>
+    selected.some((file) => file.root.id === root.id),
+  )) {
+    visibleByRoot.set(root.id, await getVisibleFilesForCodeContextRoot(root));
+  }
+
+  return uniqueStrings(
+    selected
+      .filter((file) => visibleByRoot.get(file.root.id)?.has(file.relPath))
+      .map((file) => file.id),
+  );
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function clampNumber(
+  value: unknown,
+  min: number,
+  max: number,
+  fallback: number,
+) {
+  const n =
+    typeof value === "number" && Number.isFinite(value) ? value : fallback;
+  return Math.min(Math.max(Math.floor(n), min), max);
+}
+
+function trimToolLine(line: string): string {
+  return line.length > MAX_CODE_TOOL_LINE_CHARS
+    ? `${line.slice(0, MAX_CODE_TOOL_LINE_CHARS)}…`
+    : line;
+}
+
+function codePathMatchesFilter(relPath: string, filter?: string): boolean {
+  const normalizedFilter = filter?.trim().replaceAll("\\", "/").toLowerCase();
+  if (!normalizedFilter) return true;
+  return codeContextFilterText(relPath)
+    .toLowerCase()
+    .includes(normalizedFilter);
+}
+
+function formatCodeFileTree(paths: string[], limit: number): string {
+  const lines: string[] = [];
+  const seen = new Set<string>();
+  for (const fileId of paths.slice(0, limit)) {
+    const ref = getCodeContextFileRef(fileId);
+    const rootLabel = ref?.root.name ?? "Code Context";
+    const relPath = ref?.relPath ?? fileId;
+    const rootKey = `root:${rootLabel}`;
+    if (!seen.has(rootKey)) {
+      seen.add(rootKey);
+      lines.push(`${rootLabel}/`);
+    }
+    const parts = relPath.split("/");
+    for (let i = 0; i < parts.length - 1; i++) {
+      const dirPath = `${rootLabel}:${parts.slice(0, i + 1).join("/")}`;
+      if (seen.has(dirPath)) continue;
+      seen.add(dirPath);
+      lines.push(`${"  ".repeat(i + 1)}${parts[i]}/`);
+    }
+    lines.push(`${"  ".repeat(Math.max(1, parts.length))}${parts.at(-1)}`);
+  }
+  return lines.join("\n");
+}
+
+async function readCodeTextWithinLimit(
+  relPath: string,
+  maxBytes = MAX_CODE_TOOL_READ_BYTES,
+): Promise<{ content: string; truncated: boolean; byteLength: number }> {
+  const resolved = resolveCodeContextFilePath(relPath);
+  if (!resolved) throw new Error("Access denied");
+  const buffer = await fs.readFile(resolved);
+  const truncated = buffer.byteLength > maxBytes;
+  return {
+    content: buffer.slice(0, maxBytes).toString("utf-8"),
+    truncated,
+    byteLength: buffer.byteLength,
+  };
+}
+
+async function searchCodeInFiles(
+  scopedFiles: string[],
+  params: {
+    query: string;
+    isRegex?: boolean;
+    caseSensitive?: boolean;
+    pathFilter?: string;
+    maxResults?: number;
+    contextLines?: number;
+    wholeWord?: boolean;
+  },
+) {
+  const query = params.query.trim();
+  if (!query) return { type: "error", error: "query is required" };
+  if (query.length > 500) {
+    return { type: "error", error: "query is too long" };
+  }
+
+  const maxResults = clampNumber(
+    params.maxResults,
+    1,
+    MAX_CODE_TOOL_SEARCH_RESULTS,
+    50,
+  );
+  const contextLines = clampNumber(
+    params.contextLines,
+    0,
+    MAX_CODE_TOOL_CONTEXT_LINES,
+    1,
+  );
+
+  let matcher: RegExp;
+  try {
+    const source = params.isRegex ? query : escapeRegExp(query);
+    const wholeWord =
+      params.wholeWord && /^[A-Za-z_$][\w$]*$/.test(query)
+        ? `\\b${source}\\b`
+        : source;
+    matcher = new RegExp(wholeWord, params.caseSensitive ? "" : "i");
+  } catch (err: any) {
+    return { type: "error", error: err?.message || "Invalid regex" };
+  }
+
+  const candidateFiles = scopedFiles.filter((file) =>
+    codePathMatchesFilter(file, params.pathFilter),
+  );
+  const matches: Array<{
+    path: string;
+    displayPath: string;
+    line: number;
+    lineText: string;
+    before: Array<{ line: number; text: string }>;
+    after: Array<{ line: number; text: string }>;
+  }> = [];
+  const truncatedFiles: string[] = [];
+  const unreadableFiles: string[] = [];
+
+  for (const relPath of candidateFiles) {
+    let content: string;
+    try {
+      const read = await readCodeTextWithinLimit(
+        relPath,
+        MAX_CODE_TOOL_SEARCH_FILE_BYTES,
+      );
+      content = read.content;
+      if (read.truncated) truncatedFiles.push(relPath);
+    } catch {
+      unreadableFiles.push(relPath);
+      continue;
+    }
+
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      if (!matcher.test(lines[i])) continue;
+      matcher.lastIndex = 0;
+      const beforeStart = Math.max(0, i - contextLines);
+      const afterEnd = Math.min(lines.length, i + contextLines + 1);
+      matches.push({
+        path: relPath,
+        displayPath: codeContextDisplayPath(relPath),
+        line: i + 1,
+        lineText: trimToolLine(lines[i]),
+        before: lines.slice(beforeStart, i).map((text, offset) => ({
+          line: beforeStart + offset + 1,
+          text: trimToolLine(text),
+        })),
+        after: lines.slice(i + 1, afterEnd).map((text, offset) => ({
+          line: i + offset + 2,
+          text: trimToolLine(text),
+        })),
+      });
+      if (matches.length >= maxResults) {
+        return {
+          query,
+          searchedFiles: candidateFiles.length,
+          truncated: true,
+          truncatedFiles,
+          unreadableFiles,
+          matches,
+        };
+      }
+    }
+  }
+
+  return {
+    query,
+    searchedFiles: candidateFiles.length,
+    truncated: false,
+    truncatedFiles,
+    unreadableFiles,
+    matches,
+  };
+}
+
+function classifyConfigFile(relPath: string): string | null {
+  const lower = codeContextRelPath(relPath).toLowerCase();
+  const base = lower.split("/").at(-1) || lower;
+  if (/^\.github\/workflows\/.+\.ya?ml$/.test(lower)) {
+    return "github-actions-workflow";
+  }
+  if (base === "action.yml" || base === "action.yaml") return "github-action";
+  if (base === "azure-pipelines.yml" || base === "azure-pipelines.yaml") {
+    return "azure-pipelines";
+  }
+  if (base === ".gitlab-ci.yml" || base === ".gitlab-ci.yaml") {
+    return "gitlab-ci";
+  }
+  if (base === "config.yml" && lower.includes(".circleci/")) {
+    return "circleci";
+  }
+  if (base === "jenkinsfile") return "jenkins";
+  if (lower.includes("buildkite") && lower.endsWith(".yml")) {
+    return "buildkite";
+  }
+  if (base === "package.json") return "package-json";
+  if (base === "dockerfile" || base.endsWith(".dockerfile")) {
+    return "dockerfile";
+  }
+  if (
+    base === "docker-compose.yml" ||
+    base === "docker-compose.yaml" ||
+    base === "compose.yml" ||
+    base === "compose.yaml"
+  ) {
+    return "docker-compose";
+  }
+  if (lower.endsWith(".tf") || lower.endsWith(".tfvars")) return "terraform";
+  if (lower.includes("terraform/") && lower.endsWith(".hcl")) {
+    return "terraform-hcl";
+  }
+  return null;
+}
+
+function summarizeConfigStructure(relPath: string, content: string) {
+  const relativePath = codeContextRelPath(relPath);
+  const lower = relativePath.toLowerCase();
+  if (lower.endsWith(".json")) {
+    try {
+      const parsed = JSON.parse(content);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const record = parsed as Record<string, unknown>;
+        return {
+          topLevelKeys: Object.keys(record).slice(0, 50),
+          scripts:
+            record.scripts && typeof record.scripts === "object"
+              ? Object.keys(record.scripts as Record<string, unknown>).slice(
+                  0,
+                  50,
+                )
+              : undefined,
+        };
+      }
+    } catch {
+      return { parseError: "Invalid JSON" };
+    }
+  }
+
+  if (/\.ya?ml$/i.test(relativePath)) {
+    const topLevelKeys = uniqueStrings(
+      content
+        .split(/\r?\n/)
+        .map((line) => line.match(/^([A-Za-z0-9_.-]+):/)?.[1] || "")
+        .filter(Boolean),
+    ).slice(0, 50);
+    return { topLevelKeys };
+  }
+
+  if (/\.(tf|tfvars|hcl)$/i.test(relativePath)) {
+    const blocks = uniqueStrings(
+      content
+        .split(/\r?\n/)
+        .map(
+          (line) =>
+            line
+              .trim()
+              .match(
+                /^(terraform|provider|resource|module|variable|output|data|locals|backend)\b.*$/,
+              )?.[0],
+        )
+        .filter((line): line is string => Boolean(line)),
+    ).slice(0, 60);
+    return { blocks };
+  }
+
+  return {};
+}
+
+function extractConfigHighlights(content: string) {
+  const interesting =
+    /\b(terraform\s+(init|plan|apply)|backend-config|azurerm|workflow_call|secrets:\s*inherit|uses:|runs-on:|permissions:|concurrency:|jobs:|steps:|env:|provider\s+"|backend\s+"|resource\s+")/i;
+  return content
+    .split(/\r?\n/)
+    .map((text, index) => ({ line: index + 1, text: trimToolLine(text) }))
+    .filter(({ text }) => interesting.test(text))
+    .slice(0, 30);
+}
+
+function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
+  if (CODE_CONTEXT_ROOTS.length === 0 || scopedCodeFiles.length === 0)
+    return {};
+
+  const files = uniqueStrings(scopedCodeFiles).sort((a, b) =>
+    a.localeCompare(b),
+  );
+  const fileSet = new Set(files);
+
+  return {
+    listCodeFiles: tool({
+      description:
+        "List code-context files that are available to the model. This is read-only and restricted to files the user selected in Code Context, under configured code roots, after ignore rules are applied.",
+      inputSchema: z.object({
+        query: z
+          .string()
+          .optional()
+          .describe(
+            "Optional case-insensitive path substring to filter files.",
+          ),
+        folder: z
+          .string()
+          .optional()
+          .describe(
+            "Optional folder prefix or path substring to narrow results.",
+          ),
+        limit: z
+          .number()
+          .int()
+          .min(1)
+          .max(MAX_CODE_TOOL_LIST_RESULTS)
+          .optional(),
+      }),
+      execute: async ({ query, folder, limit }) => {
+        const cappedLimit = clampNumber(
+          limit,
+          1,
+          MAX_CODE_TOOL_LIST_RESULTS,
+          120,
+        );
+        const filtered = files.filter(
+          (file) =>
+            codePathMatchesFilter(file, query) &&
+            codePathMatchesFilter(file, folder),
+        );
+        const listed = filtered.slice(0, cappedLimit);
+        return {
+          scope: "selected-code-context-files",
+          totalAvailable: files.length,
+          totalMatched: filtered.length,
+          truncated: filtered.length > listed.length,
+          files: listed,
+          displayFiles: listed.map(codeContextDisplayPath),
+          tree: formatCodeFileTree(listed, cappedLimit),
+        };
+      },
+    }),
+    searchCode: tool({
+      description:
+        "Search text across available code-context files. Use this before opening many files. It cannot see ignored or unselected files.",
+      inputSchema: z.object({
+        query: z.string().describe("Text or regex to search for."),
+        isRegex: z
+          .boolean()
+          .optional()
+          .describe("Treat query as a JavaScript regular expression."),
+        caseSensitive: z.boolean().optional(),
+        pathFilter: z
+          .string()
+          .optional()
+          .describe(
+            "Optional path substring, e.g. .github/workflows or terraform.",
+          ),
+        maxResults: z
+          .number()
+          .int()
+          .min(1)
+          .max(MAX_CODE_TOOL_SEARCH_RESULTS)
+          .optional(),
+        contextLines: z
+          .number()
+          .int()
+          .min(0)
+          .max(MAX_CODE_TOOL_CONTEXT_LINES)
+          .optional(),
+      }),
+      execute: async (params) => searchCodeInFiles(files, params),
+    }),
+    readCodeFile: tool({
+      description:
+        "Read one available code-context file by canonical path, optionally with a 1-based line range. Restricted to selected, non-ignored files.",
+      inputSchema: z.object({
+        path: z
+          .string()
+          .describe(
+            "Canonical path from listCodeFiles, e.g. root::src/file.ts. Legacy relative paths resolve against the first root.",
+          ),
+        startLine: z.number().int().min(1).optional(),
+        endLine: z.number().int().min(1).optional(),
+      }),
+      execute: async ({ path: requestedPath, startLine, endLine }) => {
+        const ref = getCodeContextFileRef(requestedPath || "");
+        const fileId = ref?.id;
+        if (!ref || !fileId || !fileSet.has(fileId)) {
+          return {
+            type: "error",
+            error:
+              "File is not available. Use listCodeFiles first; only selected, non-ignored files can be read.",
+          };
+        }
+
+        try {
+          const read = await readCodeTextWithinLimit(fileId);
+          const lines = read.content.split(/\r?\n/);
+          const totalLines = lines.length;
+          const first = clampNumber(startLine, 1, totalLines || 1, 1);
+          const last = clampNumber(
+            endLine,
+            first,
+            totalLines || first,
+            totalLines || first,
+          );
+          const numbered = lines
+            .slice(first - 1, last)
+            .map((line, index) => `${first + index}: ${line}`)
+            .join("\n");
+          return {
+            path: fileId,
+            displayPath: codeContextDisplayPath(fileId),
+            startLine: first,
+            endLine: last,
+            totalLines,
+            byteLength: read.byteLength,
+            truncated: read.truncated,
+            content: numbered,
+          };
+        } catch (err: any) {
+          return {
+            type: "error",
+            error: err?.message || "Could not read file",
+          };
+        }
+      },
+    }),
+    findCodeReferences: tool({
+      description:
+        "Find textual references to a symbol, function name, workflow name, file name, variable, or config key across available code-context files.",
+      inputSchema: z.object({
+        symbol: z.string().describe("Exact symbol or phrase to find."),
+        pathFilter: z.string().optional(),
+        caseSensitive: z.boolean().optional(),
+        maxResults: z
+          .number()
+          .int()
+          .min(1)
+          .max(MAX_CODE_TOOL_SEARCH_RESULTS)
+          .optional(),
+        contextLines: z
+          .number()
+          .int()
+          .min(0)
+          .max(MAX_CODE_TOOL_CONTEXT_LINES)
+          .optional(),
+      }),
+      execute: async ({
+        symbol,
+        pathFilter,
+        caseSensitive,
+        maxResults,
+        contextLines,
+      }) =>
+        searchCodeInFiles(files, {
+          query: symbol,
+          pathFilter,
+          caseSensitive,
+          maxResults,
+          contextLines,
+          wholeWord: true,
+        }),
+    }),
+    inspectCiConfig: tool({
+      description:
+        "Find and summarize CI/CD, GitHub Actions, Docker, package script, and Terraform config files among the available code-context files.",
+      inputSchema: z.object({
+        pathFilter: z.string().optional(),
+        maxFiles: z.number().int().min(1).max(30).optional(),
+      }),
+      execute: async ({ pathFilter, maxFiles }) => {
+        const limit = clampNumber(maxFiles, 1, 30, 12);
+        const candidates = files
+          .map((file) => ({ file, kind: classifyConfigFile(file) }))
+          .filter(
+            (entry): entry is { file: string; kind: string } =>
+              Boolean(entry.kind) &&
+              codePathMatchesFilter(entry.file, pathFilter),
+          );
+
+        const inspected = [];
+        for (const { file, kind } of candidates.slice(0, limit)) {
+          try {
+            const read = await readCodeTextWithinLimit(file);
+            inspected.push({
+              path: file,
+              displayPath: codeContextDisplayPath(file),
+              kind,
+              truncated: read.truncated,
+              structure: summarizeConfigStructure(file, read.content),
+              highlights: extractConfigHighlights(read.content),
+            });
+          } catch (err: any) {
+            inspected.push({
+              path: file,
+              displayPath: codeContextDisplayPath(file),
+              kind,
+              error: err?.message || "Could not inspect file",
+            });
+          }
+        }
+
+        return {
+          totalConfigFiles: candidates.length,
+          truncated: candidates.length > inspected.length,
+          files: inspected,
+        };
+      },
+    }),
+    runReadOnlyCodeCommand: tool({
+      description:
+        "Run a safe, whitelisted, read-only repository inspection command without a shell. Allowed commands: pwd, find, rg, git-ls-files, git-log, git-blame. Results are restricted to selected code-context files.",
+      inputSchema: z.object({
+        command: z.enum([
+          "pwd",
+          "find",
+          "rg",
+          "git-ls-files",
+          "git-log",
+          "git-blame",
+        ]),
+        query: z
+          .string()
+          .optional()
+          .describe("Required for rg. Optional for find."),
+        path: z
+          .string()
+          .optional()
+          .describe("Required for git-log and git-blame."),
+        pathFilter: z.string().optional(),
+        startLine: z.number().int().min(1).optional(),
+        endLine: z.number().int().min(1).optional(),
+        maxResults: z
+          .number()
+          .int()
+          .min(1)
+          .max(MAX_CODE_TOOL_LIST_RESULTS)
+          .optional(),
+      }),
+      execute: async ({
+        command,
+        query,
+        path: requestedPath,
+        pathFilter,
+        startLine,
+        endLine,
+        maxResults,
+      }) => {
+        const limit = clampNumber(
+          maxResults,
+          1,
+          MAX_CODE_TOOL_LIST_RESULTS,
+          100,
+        );
+        if (command === "pwd") {
+          return {
+            command: "pwd",
+            roots: CODE_CONTEXT_ROOTS.map((root) => ({
+              id: root.id,
+              name: root.name,
+              path: root.dir,
+            })),
+            note: "Read-only tools are still restricted to selected, non-ignored code-context files across these roots.",
+          };
+        }
+        if (command === "find") {
+          const filtered = files
+            .filter(
+              (file) =>
+                codePathMatchesFilter(file, query) &&
+                codePathMatchesFilter(file, pathFilter),
+            )
+            .slice(0, limit);
+          return {
+            command: "find",
+            files: filtered,
+            displayFiles: filtered.map(codeContextDisplayPath),
+            truncated: filtered.length >= limit,
+          };
+        }
+        if (command === "rg") {
+          if (!query?.trim())
+            return { type: "error", error: "query is required for rg" };
+          return searchCodeInFiles(files, {
+            query,
+            pathFilter,
+            maxResults: Math.min(limit, MAX_CODE_TOOL_SEARCH_RESULTS),
+            contextLines: 1,
+          });
+        }
+
+        if (command === "git-ls-files") {
+          try {
+            const matchingFiles: string[] = [];
+            const roots = CODE_CONTEXT_ROOTS.filter((root) =>
+              files.some(
+                (file) => getCodeContextFileRef(file)?.root.id === root.id,
+              ),
+            );
+            const errors: string[] = [];
+
+            for (const root of roots) {
+              const result = await runGit(["ls-files", "-z"], {
+                cwd: root.dir,
+                allowFail: true,
+                timeoutMs: 5000,
+                maxBuffer: 1024 * 1024,
+              });
+              if (result.code !== 0) {
+                errors.push(
+                  `${root.name}: ${result.stderr.trim() || "git ls-files failed"}`,
+                );
+                continue;
+              }
+              const tracked = new Set(
+                result.stdout.split("\0").filter(Boolean),
+              );
+              for (const file of files) {
+                const ref = getCodeContextFileRef(file);
+                if (ref?.root.id !== root.id) continue;
+                if (
+                  tracked.has(ref.relPath) &&
+                  codePathMatchesFilter(file, pathFilter)
+                ) {
+                  matchingFiles.push(file);
+                }
+              }
+            }
+            const filtered = matchingFiles.slice(0, limit);
+            return {
+              command: "git ls-files",
+              files: filtered,
+              displayFiles: filtered.map(codeContextDisplayPath),
+              errors,
+              truncated: filtered.length >= limit,
+            };
+          } catch (err: any) {
+            return {
+              type: "error",
+              error: err?.message || "git ls-files failed",
+            };
+          }
+        }
+
+        const fileRef = getCodeContextFileRef(requestedPath || "");
+        const fileId = fileRef?.id;
+        if (!fileRef || !fileId || !fileSet.has(fileId)) {
+          return {
+            type: "error",
+            error:
+              "path must be one of the selected, non-ignored code-context files",
+          };
+        }
+
+        if (command === "git-log") {
+          try {
+            const result = await runGit(
+              [
+                "log",
+                "--oneline",
+                "--decorate",
+                `--max-count=${Math.min(limit, 50)}`,
+                "--",
+                fileRef.relPath,
+              ],
+              {
+                cwd: fileRef.root.dir,
+                allowFail: true,
+                timeoutMs: 5000,
+                maxBuffer: 512 * 1024,
+              },
+            );
+            return {
+              command: "git log",
+              path: fileId,
+              displayPath: codeContextDisplayPath(fileId),
+              output:
+                result.stdout.trim() ||
+                result.stderr.trim() ||
+                "No git history found.",
+            };
+          } catch (err: any) {
+            return { type: "error", error: err?.message || "git log failed" };
+          }
+        }
+
+        try {
+          const args = ["blame", "--date=short"];
+          if (startLine || endLine) {
+            const first = Math.max(1, startLine ?? 1);
+            const last = Math.max(first, endLine ?? first);
+            args.push("-L", `${first},${last}`);
+          }
+          args.push("--", fileRef.relPath);
+          const result = await runGit(args, {
+            cwd: fileRef.root.dir,
+            allowFail: true,
+            timeoutMs: 5000,
+            maxBuffer: 512 * 1024,
+          });
+          return {
+            command: "git blame",
+            path: fileId,
+            displayPath: codeContextDisplayPath(fileId),
+            output:
+              result.stdout.trim() ||
+              result.stderr.trim() ||
+              "No git blame output.",
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "git blame failed" };
+        }
+      },
+    }),
+  };
+}
+
+function createGitDiffTools(ctx: GitDiffContextPayload): ToolSet {
+  if (
+    GIT_DIFF_ROOTS.length === 0 ||
+    !Array.isArray(ctx.selectedFiles) ||
+    ctx.selectedFiles.length === 0
+  ) {
+    return {};
+  }
+
+  async function loadScoped() {
+    const scoped = await getScopedGitDiffContext(ctx);
+    if (!scoped) {
+      throw new Error(
+        "No selected git diff files are available for this root/range.",
+      );
+    }
+    return scoped;
+  }
+
+  function formatEntry(entry: ScopedGitDiffEntry) {
+    return {
+      path: entry.id,
+      displayPath: entry.displayPath,
+      relativePath: entry.path,
+      oldPath: entry.oldPath,
+      status: entry.status,
+      additions: entry.additions,
+      deletions: entry.deletions,
+      binary: entry.binary,
+    };
+  }
+
+  return {
+    listGitDiffFiles: tool({
+      description:
+        "List selected git diff files for the configured diff root/range. Restricted to files the user selected in Git Diff context.",
+      inputSchema: z.object({
+        query: z
+          .string()
+          .optional()
+          .describe("Optional case-insensitive path/root/status filter."),
+        status: z
+          .enum(["A", "M", "D", "R", "C", "T", "U", "?"])
+          .optional()
+          .describe("Optional git status filter."),
+        limit: z.number().int().min(1).max(500).optional(),
+      }),
+      execute: async ({ query, status, limit }) => {
+        try {
+          const scoped = await loadScoped();
+          const filter = query?.trim().toLowerCase();
+          const cappedLimit = clampNumber(limit, 1, 500, 200);
+          const matched = scoped.entries.filter((entry) => {
+            if (status && entry.status !== status) return false;
+            if (!filter) return true;
+            return `${entry.id} ${entry.displayPath} ${entry.status}`
+              .toLowerCase()
+              .includes(filter);
+          });
+          return {
+            root: {
+              id: scoped.root.id,
+              name: scoped.root.name,
+            },
+            range: scoped.rangeLabel,
+            totalSelected: scoped.entries.length,
+            totalMatched: matched.length,
+            truncated: matched.length > cappedLimit,
+            files: matched.slice(0, cappedLimit).map(formatEntry),
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "diff list failed" };
+        }
+      },
+    }),
+    readGitDiffFile: tool({
+      description:
+        "Read a selected git diff file as a patch, before blob, or after blob. Use patch for exact changed hunks; use before/after to compare full file versions.",
+      inputSchema: z.object({
+        path: z
+          .string()
+          .describe(
+            "Canonical path from listGitDiffFiles, e.g. root::src/file.ts. Legacy relative paths resolve against the selected diff root.",
+          ),
+        view: z
+          .enum(["patch", "before", "after"])
+          .optional()
+          .describe("Which diff view to read. Defaults to patch."),
+        startLine: z.number().int().min(1).optional(),
+        endLine: z.number().int().min(1).optional(),
+      }),
+      execute: async ({ path: requestedPath, view, startLine, endLine }) => {
+        try {
+          const scoped = await loadScoped();
+          const entry = findScopedGitDiffEntry(scoped, requestedPath);
+          if (!entry) {
+            return {
+              type: "error",
+              error: "File is not in the selected git diff context.",
+            };
+          }
+          const selectedView = view ?? "patch";
+          const content = await readGitDiffView(scoped, entry, selectedView);
+          const lines = content.split(/\r?\n/);
+          const totalLines = lines.length;
+          const first = clampNumber(startLine, 1, totalLines || 1, 1);
+          const last = clampNumber(
+            endLine,
+            first,
+            totalLines || first,
+            totalLines || first,
+          );
+          const selectedLines = lines
+            .slice(first - 1, last)
+            .map((line, index) => `${first + index}: ${line}`)
+            .join("\n");
+          return {
+            path: entry.id,
+            displayPath: entry.displayPath,
+            view: selectedView,
+            status: entry.status,
+            startLine: first,
+            endLine: last,
+            totalLines,
+            content: selectedLines || "(empty)",
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "diff read failed" };
+        }
+      },
+    }),
+    searchGitDiff: tool({
+      description:
+        "Search selected git diff patches and/or before/after blobs for exact text or a regular expression. Useful for finding specific changed symbols, config keys, or hunks.",
+      inputSchema: z.object({
+        query: z.string().min(1),
+        view: z
+          .enum(["patch", "before", "after", "all"])
+          .optional()
+          .describe("Which view to search. Defaults to patch."),
+        regex: z.boolean().optional(),
+        caseSensitive: z.boolean().optional(),
+        pathFilter: z.string().optional(),
+        limit: z.number().int().min(1).max(200).optional(),
+      }),
+      execute: async ({
+        query,
+        view,
+        regex,
+        caseSensitive,
+        pathFilter,
+        limit,
+      }) => {
+        try {
+          const scoped = await loadScoped();
+          const cappedLimit = clampNumber(limit, 1, 200, 80);
+          const selectedView = view ?? "patch";
+          const flags = caseSensitive ? "" : "i";
+          const pattern = new RegExp(
+            regex ? query : escapeRegExp(query),
+            flags,
+          );
+          const filter = pathFilter?.trim().toLowerCase();
+          const views =
+            selectedView === "all"
+              ? (["patch", "before", "after"] as const)
+              : ([selectedView] as const);
+          const matches: Array<{
+            path: string;
+            displayPath: string;
+            view: "patch" | "before" | "after";
+            line: number;
+            lineText: string;
+          }> = [];
+
+          for (const entry of scoped.entries) {
+            if (
+              filter &&
+              !`${entry.id} ${entry.displayPath}`.toLowerCase().includes(filter)
+            ) {
+              continue;
+            }
+            for (const currentView of views) {
+              if (
+                currentView === "before" &&
+                (entry.status === "A" || entry.status === "?")
+              ) {
+                continue;
+              }
+              if (currentView === "after" && entry.status === "D") {
+                continue;
+              }
+              const content = await readGitDiffView(scoped, entry, currentView);
+              const lines = content.split(/\r?\n/);
+              for (let i = 0; i < lines.length; i += 1) {
+                pattern.lastIndex = 0;
+                if (!pattern.test(lines[i])) continue;
+                matches.push({
+                  path: entry.id,
+                  displayPath: entry.displayPath,
+                  view: currentView,
+                  line: i + 1,
+                  lineText: trimToolLine(lines[i]),
+                });
+                if (matches.length >= cappedLimit) {
+                  return {
+                    query,
+                    view: selectedView,
+                    totalMatches: matches.length,
+                    truncated: true,
+                    matches,
+                  };
+                }
+              }
+            }
+          }
+
+          return {
+            query,
+            view: selectedView,
+            totalMatches: matches.length,
+            truncated: false,
+            matches,
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "diff search failed" };
+        }
+      },
+    }),
+    summarizeGitDiff: tool({
+      description:
+        "Summarize the selected git diff context with totals by status and additions/deletions. Use this before deeper reads when multiple files are selected.",
+      inputSchema: z.object({
+        includeFiles: z.boolean().optional(),
+      }),
+      execute: async ({ includeFiles }) => {
+        try {
+          const scoped = await loadScoped();
+          const byStatus: Record<string, number> = {};
+          let additions = 0;
+          let deletions = 0;
+          let binaryFiles = 0;
+          for (const entry of scoped.entries) {
+            byStatus[entry.status] = (byStatus[entry.status] ?? 0) + 1;
+            additions += entry.additions;
+            deletions += entry.deletions;
+            if (entry.binary) binaryFiles += 1;
+          }
+          return {
+            root: {
+              id: scoped.root.id,
+              name: scoped.root.name,
+            },
+            range: scoped.rangeLabel,
+            filesChanged: scoped.entries.length,
+            additions,
+            deletions,
+            binaryFiles,
+            byStatus,
+            ...(includeFiles
+              ? { files: scoped.entries.map(formatEntry).slice(0, 200) }
+              : {}),
+          };
+        } catch (err: any) {
+          return {
+            type: "error",
+            error: err?.message || "diff summary failed",
+          };
+        }
+      },
+    }),
+  };
+}
 
 // ─── AI Providers (Vercel AI SDK) ────────────────────────
 // Set the provider + model in .env. Supports: openai, google, anthropic
@@ -998,6 +2202,7 @@ app.patch("/api/questions/:id", async (req, res) => {
       delete q.gitDiffContext;
     } else if (gdc && typeof gdc === "object") {
       q.gitDiffContext = {
+        rootId: String(gdc.rootId || ""),
         baseRef: String(gdc.baseRef || ""),
         headRef: String(gdc.headRef || ""),
         mode:
@@ -1984,16 +3189,19 @@ app.post("/api/chat", async (req, res) => {
     }
   }
 
+  const scopedCodeContextFiles =
+    await getScopedCodeContextFiles(codeContextFiles);
+
   // Code-context files from the project directory
-  if (codeContextFiles?.length && CODE_CONTEXT_DIR) {
-    for (const filePath of codeContextFiles as string[]) {
-      const fullPath = path.join(CODE_CONTEXT_DIR, filePath);
-      const resolved = path.resolve(fullPath);
-      if (!resolved.startsWith(path.resolve(CODE_CONTEXT_DIR))) continue;
+  if (scopedCodeContextFiles.length && CODE_CONTEXT_ROOTS.length > 0) {
+    for (const filePath of scopedCodeContextFiles) {
+      const ref = getCodeContextFileRef(filePath);
+      if (!ref) continue;
       fileRegistry.set(
         `code:${filePath}`,
-        makeCodeReferenceFileEntry(`[code] ${filePath}`, () =>
-          fs.readFile(resolved, "utf-8"),
+        makeCodeReferenceFileEntry(
+          `[code:${ref.root.name}] ${ref.relPath}`,
+          () => fs.readFile(ref.absolutePath, "utf-8"),
         ),
       );
     }
@@ -2029,16 +3237,27 @@ For image files, readFile returns visual image data so you can inspect what is v
 
     if (codeFilePaths.length > 0) {
       system += `
+--- Code Context Exploration Tools ---
+You also have read-only code tools for the selected Code Context files:
+- listCodeFiles: see the selected, non-ignored file tree.
+- searchCode: search exact text or regex across selected files.
+- readCodeFile: open a selected file, optionally by line range.
+- findCodeReferences: trace textual usages of a symbol, config key, workflow, or file name.
+- inspectCiConfig: summarize CI/CD, package, Docker, and Terraform config among selected files.
+- runReadOnlyCodeCommand: safe whitelisted equivalents for pwd/find/rg/git-ls-files/git-log/git-blame.
+
+These tools cannot access files outside the configured code-context roots, files hidden by ignore rules, or files the user did not select. File IDs are root-qualified like "root::relative/path". If something is missing, ask the user to select more code context or adjust ignore settings.
+
 --- Linking Code Files in Your Response ---
 When you mention or reference one of the **[code]** files above in your response text, format it as a clickable link so the user can open it directly:
 
-  [DisplayText](coderef://relative/path/to/file)
+  [DisplayText](coderef://root::relative/path/to/file)
 
 Examples:
-  [EmployeesController](coderef://src/Controllers/EmployeesController.cs)
-  [SettleDeferredPaymentCaseRequest](coderef://src/Requests/SettleDeferredPaymentCaseRequest.cs)
+  [EmployeesController](coderef://backend::src/Controllers/EmployeesController.cs)
+  [SettleDeferredPaymentCaseRequest](coderef://api::src/Requests/SettleDeferredPaymentCaseRequest.cs)
 
-Use this for class names, method names, or any mention of a specific file from the code context. The display text should be the class, file, or concept name — not the raw path.
+Use this for class names, method names, or any mention of a specific file from the code context. The href must use the exact code file id shown above without the "code:" prefix. The display text should be the class, file, or concept name — not the raw path.
 Only use coderef:// for [code] files. Do not use it for uploaded documents.`;
     }
 
@@ -2160,6 +3379,8 @@ Examples (illustrative only — use real ids and names from the list above):
               readFile: createReadFileTool(fileRegistry),
             }
           : {}),
+        ...createCodeContextTools(scopedCodeContextFiles),
+        ...createGitDiffTools(gitDiffContext || {}),
       },
       stopWhen: stepCountIs(selectedResponseProfile.maxSteps),
     });
@@ -2359,6 +3580,24 @@ function hasIgnoredExtension(fileNameLower: string): boolean {
   return false;
 }
 
+function isCodeContextPathAllowed(relPath: string): boolean {
+  const normalized = normalizeCodeContextRelPath(relPath);
+  if (!normalized) return false;
+
+  const parts = normalized.split("/");
+  for (let i = 0; i < parts.length - 1; i++) {
+    const prefix = parts.slice(0, i + 1).join("/");
+    if (IGNORE_DIRS.has(normalizeName(parts[i])) || shouldIgnorePath(prefix)) {
+      return false;
+    }
+  }
+
+  const fileName = parts.at(-1)?.toLowerCase() ?? "";
+  if (!fileName || IGNORE_FILES.has(fileName)) return false;
+  if (shouldIgnorePath(normalized)) return false;
+  return !hasIgnoredExtension(fileName);
+}
+
 async function walkDir(dir: string, prefix = ""): Promise<string[]> {
   const entries = await fs.readdir(dir, { withFileTypes: true });
   const files: string[] = [];
@@ -2380,30 +3619,34 @@ async function walkDir(dir: string, prefix = ""): Promise<string[]> {
 }
 
 app.get("/api/code-context/tree", async (_req, res) => {
-  if (!CODE_CONTEXT_DIR) return res.json([]);
+  if (CODE_CONTEXT_ROOTS.length === 0) return res.json({ roots: [] });
   try {
-    const files = await walkDir(CODE_CONTEXT_DIR);
-    res.json(files);
+    res.json(await getCodeContextRootsTree());
   } catch {
-    res.json([]);
+    res.json({ roots: [] });
   }
 });
 
 app.get("/api/code-context/file", async (req, res) => {
-  if (!CODE_CONTEXT_DIR)
-    return res.status(400).json({ error: "No code context directory" });
+  if (CODE_CONTEXT_ROOTS.length === 0)
+    return res.status(400).json({ error: "No code context roots" });
   const filePath = req.query.path as string;
   if (!filePath) return res.status(400).json({ error: "Path required" });
 
-  const fullPath = path.join(CODE_CONTEXT_DIR, filePath);
-  const resolved = path.resolve(fullPath);
-  if (!resolved.startsWith(path.resolve(CODE_CONTEXT_DIR))) {
+  const ref = getCodeContextFileRef(filePath);
+  if (!ref) {
     return res.status(403).json({ error: "Access denied" });
   }
 
   try {
-    const content = await fs.readFile(resolved, "utf-8");
-    res.json({ path: filePath, content });
+    const content = await fs.readFile(ref.absolutePath, "utf-8");
+    res.json({
+      path: ref.id,
+      rootId: ref.root.id,
+      rootName: ref.root.name,
+      relativePath: ref.relPath,
+      content,
+    });
   } catch {
     res.status(404).json({ error: "File not found" });
   }
@@ -2416,7 +3659,108 @@ app.get("/api/code-context/file", async (req, res) => {
 // or before/after blobs are pulled lazily via the readFile tool using ids of
 // the form  gitdiff:patch:<path> / gitdiff:before:<path> / gitdiff:after:<path>.
 
-const GIT_DIFF_DIR = process.env.GIT_DIFF_DIR || CODE_CONTEXT_DIR;
+function resolveGitDiffRoots(): CodeContextRootConfig[] {
+  const specs = [
+    ...(process.env.GIT_DIFF_DIR
+      ? [
+          process.env.GIT_DIFF_NAME
+            ? `${process.env.GIT_DIFF_NAME}=${process.env.GIT_DIFF_DIR}`
+            : process.env.GIT_DIFF_DIR,
+        ]
+      : []),
+    ...splitCodeContextRootEnv(process.env.GIT_DIFF_DIRS),
+  ];
+
+  if (specs.length === 0) {
+    return CODE_CONTEXT_ROOTS.map((root) => ({ ...root }));
+  }
+
+  const seenDirs = new Set<string>();
+  const usedNames = new Map<string, number>();
+  const usedIds = new Set<string>();
+  const roots: CodeContextRootConfig[] = [];
+
+  for (const spec of specs) {
+    const parsed = parseCodeContextRootSpec(spec);
+    if (!parsed) continue;
+    const dir = path.resolve(parsed.dir);
+    if (seenDirs.has(dir)) continue;
+    seenDirs.add(dir);
+    const fallbackName = path.basename(dir) || "Git Diff";
+    const name = uniqueCodeContextRootName(
+      parsed.name || fallbackName,
+      usedNames,
+    );
+    const id = uniqueCodeContextRootId(slugForCodeContextRoot(name), usedIds);
+    roots.push({ id, name, dir });
+  }
+
+  return roots;
+}
+
+const GIT_DIFF_ROOTS = resolveGitDiffRoots();
+const GIT_DIFF_ROOT_BY_ID = new Map(
+  GIT_DIFF_ROOTS.map((root) => [root.id, root]),
+);
+const GIT_DIFF_DIR = GIT_DIFF_ROOTS[0]?.dir ?? "";
+
+function getGitDiffPrimaryRoot(): CodeContextRootConfig | null {
+  return GIT_DIFF_ROOTS[0] ?? null;
+}
+
+function getGitDiffRoot(rootId?: string | null): CodeContextRootConfig | null {
+  const normalized = rootId?.trim();
+  if (normalized) return GIT_DIFF_ROOT_BY_ID.get(normalized) ?? null;
+  return getGitDiffPrimaryRoot();
+}
+
+function makeGitDiffFileId(rootId: string, relPath: string): string {
+  return `${rootId}${CODE_CONTEXT_ROOT_SEPARATOR}${relPath}`;
+}
+
+interface GitDiffFileRef {
+  id: string;
+  root: CodeContextRootConfig;
+  relPath: string;
+}
+
+function getGitDiffFileRef(
+  fileIdOrPath: string,
+  fallbackRootId?: string,
+): GitDiffFileRef | null {
+  if (GIT_DIFF_ROOTS.length === 0) return null;
+  const raw = fileIdOrPath
+    .replace(/^gitdiff:(patch|before|after):/, "")
+    .replaceAll("\\", "/")
+    .trim();
+  if (!raw || raw.includes("\0")) return null;
+
+  const sepIdx = raw.indexOf(CODE_CONTEXT_ROOT_SEPARATOR);
+  const root =
+    sepIdx > 0
+      ? GIT_DIFF_ROOT_BY_ID.get(raw.slice(0, sepIdx))
+      : getGitDiffRoot(fallbackRootId);
+  const relRaw =
+    sepIdx > 0 ? raw.slice(sepIdx + CODE_CONTEXT_ROOT_SEPARATOR.length) : raw;
+  if (!root) return null;
+
+  const normalized = normalizeCodeContextRelPath(relRaw);
+  if (!normalized || !isCodeContextPathAllowed(normalized)) return null;
+
+  return {
+    id: makeGitDiffFileId(root.id, normalized),
+    root,
+    relPath: normalized,
+  };
+}
+
+function getGitDiffRootSummaries() {
+  return GIT_DIFF_ROOTS.map((root) => ({
+    id: root.id,
+    name: root.name,
+    path: root.dir,
+  }));
+}
 
 // Hard caps so a runaway repo can never blow up the response or the model's context.
 const MAX_DIFF_FILES = 500;
@@ -2437,6 +3781,21 @@ interface GitDiffFileEntry {
   binary: boolean;
 }
 
+interface ScopedGitDiffEntry extends GitDiffFileEntry {
+  id: string;
+  displayPath: string;
+}
+
+interface ScopedGitDiffContext {
+  root: CodeContextRootConfig;
+  base: string;
+  head: string;
+  headLabel: string;
+  mode: GitDiffMode;
+  rangeLabel: string;
+  entries: ScopedGitDiffEntry[];
+}
+
 function runGit(
   args: string[],
   opts: {
@@ -2523,13 +3882,16 @@ function isValidRef(ref: string): boolean {
   return REF_PATTERN.test(ref);
 }
 
-async function resolveRef(ref: string): Promise<string | null> {
+async function resolveRef(
+  root: CodeContextRootConfig,
+  ref: string,
+): Promise<string | null> {
   if (!isValidRef(ref)) return null;
   try {
     const { stdout } = await runGit(
       ["rev-parse", "--verify", `${ref}^{commit}`],
       {
-        cwd: GIT_DIFF_DIR,
+        cwd: root.dir,
       },
     );
     return stdout.trim() || null;
@@ -2560,6 +3922,7 @@ function buildDiffRange(
 }
 
 async function getChangedFiles(
+  root: CodeContextRootConfig,
   base: string,
   head: string,
   mode: GitDiffMode,
@@ -2569,10 +3932,10 @@ async function getChangedFiles(
 
   const nameStatus = await runGit(
     [...baseArgs, "--name-status", "-z", ...range],
-    { cwd: GIT_DIFF_DIR },
+    { cwd: root.dir },
   );
   const numStat = await runGit([...baseArgs, "--numstat", "-z", ...range], {
-    cwd: GIT_DIFF_DIR,
+    cwd: root.dir,
   });
 
   // numstat with -z uses NUL between records AND between additions/deletions/path,
@@ -2630,7 +3993,7 @@ async function getChangedFiles(
     try {
       const untracked = await runGit(
         ["ls-files", "--others", "--exclude-standard", "-z"],
-        { cwd: GIT_DIFF_DIR },
+        { cwd: root.dir },
       );
       for (const filePath of untracked.stdout
         .split("\0")
@@ -2648,10 +4011,17 @@ async function getChangedFiles(
     }
   }
 
-  return entries.slice(0, MAX_DIFF_FILES);
+  return entries
+    .filter(
+      (entry) =>
+        isCodeContextPathAllowed(entry.path) &&
+        (!entry.oldPath || isCodeContextPathAllowed(entry.oldPath)),
+    )
+    .slice(0, MAX_DIFF_FILES);
 }
 
 async function getDiffPatch(
+  root: CodeContextRootConfig,
   base: string,
   head: string,
   mode: GitDiffMode,
@@ -2668,7 +4038,7 @@ async function getDiffPatch(
       "--",
       filePath,
     ],
-    { cwd: GIT_DIFF_DIR, maxBuffer: MAX_DIFF_FILE_BYTES * 4 },
+    { cwd: root.dir, maxBuffer: MAX_DIFF_FILE_BYTES * 4 },
   );
   if (stdout.length > MAX_DIFF_FILE_BYTES) {
     return (
@@ -2679,10 +4049,16 @@ async function getDiffPatch(
   return stdout;
 }
 
-async function getFileAtRef(ref: string, filePath: string): Promise<string> {
+async function getFileAtRef(
+  root: CodeContextRootConfig,
+  ref: string,
+  filePath: string,
+): Promise<string> {
   if (ref === WORKING_TREE_SENTINEL) {
-    const resolved = path.resolve(path.join(GIT_DIFF_DIR, filePath));
-    if (!resolved.startsWith(path.resolve(GIT_DIFF_DIR))) {
+    const rootDir = path.resolve(root.dir);
+    const resolved = path.resolve(path.join(rootDir, filePath));
+    const relativeToRoot = path.relative(rootDir, resolved);
+    if (relativeToRoot.startsWith("..") || path.isAbsolute(relativeToRoot)) {
       throw new Error("Access denied");
     }
     const buf = await fs.readFile(resolved);
@@ -2695,7 +4071,7 @@ async function getFileAtRef(ref: string, filePath: string): Promise<string> {
     return buf.toString("utf-8");
   }
   const { stdout } = await runGit(["show", `${ref}:${filePath}`], {
-    cwd: GIT_DIFF_DIR,
+    cwd: root.dir,
     maxBuffer: MAX_DIFF_FILE_BYTES * 4,
   });
   if (stdout.length > MAX_DIFF_FILE_BYTES) {
@@ -2707,92 +4083,224 @@ async function getFileAtRef(ref: string, filePath: string): Promise<string> {
   return stdout;
 }
 
-app.get("/api/code-context/git/branches", async (_req, res) => {
-  if (!GIT_DIFF_DIR) return res.json({ enabled: false, branches: [] });
+async function getScopedGitDiffContext(
+  ctx: GitDiffContextPayload,
+): Promise<ScopedGitDiffContext | null> {
+  if (GIT_DIFF_ROOTS.length === 0) return null;
+  const selectedRaw = Array.isArray(ctx.selectedFiles)
+    ? ctx.selectedFiles.filter((p): p is string => typeof p === "string")
+    : [];
+  const inferredRootId =
+    ctx.rootId ||
+    selectedRaw
+      .map((p) => getGitDiffFileRef(p)?.root.id)
+      .find((id): id is string => Boolean(id));
+  const root = getGitDiffRoot(inferredRootId || null);
+  if (!root) return null;
+
+  const base = (ctx.baseRef || "").trim();
+  if (!base || !isValidRef(base)) return null;
+  const mode = parseDiffMode(ctx.mode);
+  const headRaw = (ctx.headRef || "").trim();
+  const head = mode === "working-tree" ? WORKING_TREE_SENTINEL : headRaw;
+  if (mode !== "working-tree" && (!head || !isValidRef(head))) return null;
+
+  const selectedRefs = selectedRaw
+    .map((p) => getGitDiffFileRef(p, root.id))
+    .filter((p): p is GitDiffFileRef => Boolean(p))
+    .filter((p) => p.root.id === root.id);
+  if (selectedRefs.length === 0) return null;
+
+  let changedFiles: GitDiffFileEntry[];
   try {
-    // Refresh remote-tracking refs first. This is intentionally non-interactive
-    // and time-capped so private/offline repos fall back to already-local refs.
-    await runGit(["fetch", "--all", "--prune", "--quiet"], {
-      cwd: GIT_DIFF_DIR,
-      allowFail: true,
-      timeoutMs: 8000,
-    });
+    changedFiles = await getChangedFiles(root, base, head, mode);
+  } catch {
+    return null;
+  }
+  const byPath = new Map(changedFiles.map((f) => [f.path, f]));
+  const selectedPaths = uniqueStrings(selectedRefs.map((ref) => ref.relPath));
+  const entries = selectedPaths
+    .map((relPath) => byPath.get(relPath))
+    .filter((entry): entry is GitDiffFileEntry => Boolean(entry))
+    .map((entry) => ({
+      ...entry,
+      id: makeGitDiffFileId(root.id, entry.path),
+      displayPath: `${root.name}/${entry.path}`,
+    }));
+  if (entries.length === 0) return null;
 
-    const [head, branches, tags, remotes] = await Promise.all([
-      runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: GIT_DIFF_DIR }),
-      runGit(
-        [
-          "for-each-ref",
-          "--sort=-committerdate",
-          `--count=${MAX_BRANCHES}`,
-          "--format=%(refname:short)",
-          "refs/heads/",
-          "refs/remotes/",
-        ],
-        { cwd: GIT_DIFF_DIR },
-      ),
-      runGit(
-        [
-          "for-each-ref",
-          "--sort=-creatordate",
-          "--count=50",
-          "--format=%(refname:short)",
-          "refs/tags/",
-        ],
-        { cwd: GIT_DIFF_DIR, allowFail: true },
-      ),
-      runGit(["remote"], { cwd: GIT_DIFF_DIR, allowFail: true }),
-    ]);
-    const remoteNames = remotes.stdout
-      .split("\n")
-      .map((s) => s.trim())
-      .filter(Boolean);
-    const lsRemoteResults = await Promise.all(
-      remoteNames.slice(0, 5).map((remote) =>
-        runGit(["ls-remote", "--heads", remote], {
-          cwd: GIT_DIFF_DIR,
-          allowFail: true,
-          timeoutMs: 5000,
-          maxBuffer: 1024 * 1024,
-        }).then((result) =>
-          result.stdout
-            .split("\n")
-            .map((line) => line.trim().split("\t")[1] || "")
-            .filter((ref) => ref.startsWith("refs/heads/"))
-            .map((ref) => `${remote}/${ref.replace("refs/heads/", "")}`),
-        ),
+  const headLabel = mode === "working-tree" ? "working tree" : head;
+  const rangeLabel =
+    mode === "working-tree"
+      ? `${base} → working tree`
+      : `${base} ${mode === "two-dot" ? ".." : "..."} ${headLabel}`;
+
+  return {
+    root,
+    base,
+    head,
+    headLabel,
+    mode,
+    rangeLabel,
+    entries,
+  };
+}
+
+function findScopedGitDiffEntry(
+  scoped: ScopedGitDiffContext,
+  fileIdOrPath: string,
+): ScopedGitDiffEntry | null {
+  const ref = getGitDiffFileRef(fileIdOrPath, scoped.root.id);
+  if (!ref || ref.root.id !== scoped.root.id) return null;
+  return (
+    scoped.entries.find(
+      (entry) => entry.id === ref.id || entry.path === ref.relPath,
+    ) ?? null
+  );
+}
+
+async function readGitDiffView(
+  scoped: ScopedGitDiffContext,
+  entry: ScopedGitDiffEntry,
+  view: "patch" | "before" | "after",
+): Promise<string> {
+  if (view === "before") {
+    if (entry.status === "A" || entry.status === "?") return "";
+    return getFileAtRef(scoped.root, scoped.base, entry.oldPath ?? entry.path);
+  }
+  if (view === "after") {
+    if (entry.status === "D") return "";
+    const ref =
+      scoped.mode === "working-tree" ? WORKING_TREE_SENTINEL : scoped.head;
+    return getFileAtRef(scoped.root, ref, entry.path);
+  }
+  return getDiffPatch(
+    scoped.root,
+    scoped.base,
+    scoped.head,
+    scoped.mode,
+    entry.path,
+  );
+}
+
+async function loadGitBranchesForRoot(root: CodeContextRootConfig) {
+  // Refresh remote-tracking refs first. This is intentionally non-interactive
+  // and time-capped so private/offline repos fall back to already-local refs.
+  await runGit(["fetch", "--all", "--prune", "--quiet"], {
+    cwd: root.dir,
+    allowFail: true,
+    timeoutMs: 8000,
+  });
+
+  const [head, branches, tags, remotes] = await Promise.all([
+    runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root.dir }),
+    runGit(
+      [
+        "for-each-ref",
+        "--sort=-committerdate",
+        `--count=${MAX_BRANCHES}`,
+        "--format=%(refname:short)",
+        "refs/heads/",
+        "refs/remotes/",
+      ],
+      { cwd: root.dir },
+    ),
+    runGit(
+      [
+        "for-each-ref",
+        "--sort=-creatordate",
+        "--count=50",
+        "--format=%(refname:short)",
+        "refs/tags/",
+      ],
+      { cwd: root.dir, allowFail: true },
+    ),
+    runGit(["remote"], { cwd: root.dir, allowFail: true }),
+  ]);
+  const remoteNames = remotes.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const lsRemoteResults = await Promise.all(
+    remoteNames.slice(0, 5).map((remote) =>
+      runGit(["ls-remote", "--heads", remote], {
+        cwd: root.dir,
+        allowFail: true,
+        timeoutMs: 5000,
+        maxBuffer: 1024 * 1024,
+      }).then((result) =>
+        result.stdout
+          .split("\n")
+          .map((line) => line.trim().split("\t")[1] || "")
+          .filter((ref) => ref.startsWith("refs/heads/"))
+          .map((ref) => `${remote}/${ref.replace("refs/heads/", "")}`),
       ),
-    );
-    const branchList = uniqueStrings([
-      ...branches.stdout
-        .split("\n")
-        .map((s) => s.trim())
-        .filter(Boolean),
-      ...lsRemoteResults.flat(),
-    ]).filter((b) => !b.endsWith("/HEAD"));
-    const tagList = tags.stdout
+    ),
+  );
+  const branchList = uniqueStrings([
+    ...branches.stdout
       .split("\n")
       .map((s) => s.trim())
-      .filter(Boolean);
-    const currentHead = head.stdout.trim();
+      .filter(Boolean),
+    ...lsRemoteResults.flat(),
+  ]).filter((b) => !b.endsWith("/HEAD"));
+  const tagList = tags.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const currentHead = head.stdout.trim();
+
+  return {
+    enabled: true,
+    rootId: root.id,
+    rootName: root.name,
+    head: currentHead,
+    defaultBranch: chooseDefaultBaseBranch(currentHead, branchList),
+    branches: branchList,
+    tags: tagList,
+  };
+}
+
+app.get("/api/code-context/git/branches", async (req, res) => {
+  const roots = getGitDiffRootSummaries();
+  if (GIT_DIFF_ROOTS.length === 0) {
+    return res.json({ enabled: false, branches: [], roots });
+  }
+  const root = getGitDiffRoot(
+    String(req.query.root || req.query.rootId || "").trim(),
+  );
+  if (!root) {
+    return res.status(404).json({
+      enabled: false,
+      branches: [],
+      roots,
+      error: "Git diff root not found",
+    });
+  }
+  try {
     res.json({
-      enabled: true,
-      head: currentHead,
-      defaultBranch: chooseDefaultBaseBranch(currentHead, branchList),
-      branches: branchList,
-      tags: tagList,
+      ...(await loadGitBranchesForRoot(root)),
+      roots,
     });
   } catch (err: any) {
     res.status(500).json({
       enabled: false,
+      rootId: root.id,
+      rootName: root.name,
       branches: [],
+      roots,
       error: err?.message || "git not available",
     });
   }
 });
 
 app.get("/api/code-context/git/diff-tree", async (req, res) => {
-  if (!GIT_DIFF_DIR) return res.status(400).json({ error: "No git directory" });
+  if (GIT_DIFF_ROOTS.length === 0)
+    return res.status(400).json({ error: "No git diff roots" });
+  const root = getGitDiffRoot(
+    String(req.query.root || req.query.rootId || "").trim(),
+  );
+  if (!root) return res.status(404).json({ error: "Git diff root not found" });
 
   const base = String(req.query.base || "").trim();
   const headRaw = String(req.query.head || "").trim();
@@ -2801,7 +4309,7 @@ app.get("/api/code-context/git/diff-tree", async (req, res) => {
   if (!isValidRef(base))
     return res.status(400).json({ error: "Invalid base ref" });
 
-  const baseSha = await resolveRef(base);
+  const baseSha = await resolveRef(root, base);
   if (!baseSha) return res.status(404).json({ error: "Base ref not found" });
 
   let head = headRaw;
@@ -2811,13 +4319,15 @@ app.get("/api/code-context/git/diff-tree", async (req, res) => {
   } else {
     if (!isValidRef(head))
       return res.status(400).json({ error: "Invalid head ref" });
-    headSha = await resolveRef(head);
+    headSha = await resolveRef(root, head);
     if (!headSha) return res.status(404).json({ error: "Head ref not found" });
   }
 
   try {
-    const files = await getChangedFiles(base, head, mode);
+    const files = await getChangedFiles(root, base, head, mode);
     res.json({
+      rootId: root.id,
+      rootName: root.name,
       base,
       baseSha,
       head: mode === "working-tree" ? WORKING_TREE_SENTINEL : head,
@@ -2832,20 +4342,27 @@ app.get("/api/code-context/git/diff-tree", async (req, res) => {
 });
 
 app.get("/api/code-context/git/diff-file", async (req, res) => {
-  if (!GIT_DIFF_DIR) return res.status(400).json({ error: "No git directory" });
+  if (GIT_DIFF_ROOTS.length === 0)
+    return res.status(400).json({ error: "No git diff roots" });
 
   const base = String(req.query.base || "").trim();
   const headRaw = String(req.query.head || "").trim();
   const mode = parseDiffMode(req.query.mode);
   const filePath = String(req.query.path || "").trim();
   const view = (req.query.view as string) || "patch";
+  const fileRef = getGitDiffFileRef(
+    filePath,
+    String(req.query.root || req.query.rootId || "").trim(),
+  );
 
   if (!isValidRef(base))
     return res.status(400).json({ error: "Invalid base ref" });
-  if (!filePath || filePath.includes("\0"))
-    return res.status(400).json({ error: "Invalid path" });
+  if (!fileRef) return res.status(400).json({ error: "Invalid path" });
 
-  const baseSha = await resolveRef(base);
+  const { root } = fileRef;
+  const relPath = fileRef.relPath;
+
+  const baseSha = await resolveRef(root, base);
   if (!baseSha) return res.status(404).json({ error: "Base ref not found" });
 
   let head = headRaw;
@@ -2854,15 +4371,15 @@ app.get("/api/code-context/git/diff-file", async (req, res) => {
   } else {
     if (!isValidRef(head))
       return res.status(400).json({ error: "Invalid head ref" });
-    const headSha = await resolveRef(head);
+    const headSha = await resolveRef(root, head);
     if (!headSha) return res.status(404).json({ error: "Head ref not found" });
   }
 
   // Verify the path is actually part of the diff so callers cannot read arbitrary repo files.
   let entry: GitDiffFileEntry | undefined;
   try {
-    const files = await getChangedFiles(base, head, mode);
-    entry = files.find((f) => f.path === filePath || f.oldPath === filePath);
+    const files = await getChangedFiles(root, base, head, mode);
+    entry = files.find((f) => f.path === relPath || f.oldPath === relPath);
   } catch (err: any) {
     return res.status(500).json({ error: err?.message || "git diff failed" });
   }
@@ -2871,23 +4388,53 @@ app.get("/api/code-context/git/diff-file", async (req, res) => {
   try {
     if (view === "before") {
       if (entry.status === "A" || entry.status === "?") {
-        return res.json({ path: filePath, view, content: "" });
+        return res.json({
+          path: fileRef.id,
+          rootId: root.id,
+          rootName: root.name,
+          view,
+          content: "",
+        });
       }
-      const refPath = entry.oldPath ?? filePath;
-      const content = await getFileAtRef(base, refPath);
-      return res.json({ path: filePath, view, content });
+      const refPath = entry.oldPath ?? relPath;
+      const content = await getFileAtRef(root, base, refPath);
+      return res.json({
+        path: fileRef.id,
+        rootId: root.id,
+        rootName: root.name,
+        view,
+        content,
+      });
     }
     if (view === "after") {
       if (entry.status === "D") {
-        return res.json({ path: filePath, view, content: "" });
+        return res.json({
+          path: fileRef.id,
+          rootId: root.id,
+          rootName: root.name,
+          view,
+          content: "",
+        });
       }
       const ref = mode === "working-tree" ? WORKING_TREE_SENTINEL : head;
-      const content = await getFileAtRef(ref, filePath);
-      return res.json({ path: filePath, view, content });
+      const content = await getFileAtRef(root, ref, relPath);
+      return res.json({
+        path: fileRef.id,
+        rootId: root.id,
+        rootName: root.name,
+        view,
+        content,
+      });
     }
     // default: patch
-    const patch = await getDiffPatch(base, head, mode, filePath);
-    return res.json({ path: filePath, view: "patch", content: patch });
+    const patch = await getDiffPatch(root, base, head, mode, relPath);
+    return res.json({
+      path: fileRef.id,
+      rootId: root.id,
+      rootName: root.name,
+      view: "patch",
+      content: patch,
+    });
   } catch (err: any) {
     res.status(500).json({ error: err?.message || "git read failed" });
   }
@@ -2971,15 +4518,18 @@ app.post("/api/code-line-ask", async (req, res) => {
       }
     }
 
-    if (codeContextFiles?.length && CODE_CONTEXT_DIR) {
-      for (const fp of codeContextFiles as string[]) {
-        const fullPath = path.join(CODE_CONTEXT_DIR, fp);
-        const resolved = path.resolve(fullPath);
-        if (!resolved.startsWith(path.resolve(CODE_CONTEXT_DIR))) continue;
+    const scopedCodeContextFiles =
+      await getScopedCodeContextFiles(codeContextFiles);
+
+    if (scopedCodeContextFiles.length && CODE_CONTEXT_ROOTS.length > 0) {
+      for (const fp of scopedCodeContextFiles) {
+        const ref = getCodeContextFileRef(fp);
+        if (!ref) continue;
         fileRegistry.set(
           `code:${fp}`,
-          makeCodeReferenceFileEntry(`[code] ${fp}`, () =>
-            fs.readFile(resolved, "utf-8"),
+          makeCodeReferenceFileEntry(
+            `[code:${ref.root.name}] ${ref.relPath}`,
+            () => fs.readFile(ref.absolutePath, "utf-8"),
           ),
         );
       }
@@ -3020,7 +4570,7 @@ app.post("/api/code-line-ask", async (req, res) => {
       }
 
       if (codeFilePaths.length > 0) {
-        system += `\n--- Linking Code Files in Your Response ---\nWhen you mention a [code] file, format it as a clickable link:\n  [DisplayText](coderef://relative/path/to/file)\nOnly use coderef:// for [code] files.`;
+        system += `\n--- Code Context Exploration Tools ---\nYou also have read-only tools to list, search, read line ranges, trace textual references, inspect CI/CD config, and run whitelisted read-only inspection commands. These tools are restricted to selected, non-ignored files under configured code-context roots. File IDs are root-qualified like "root::relative/path". If something is missing, ask the user to select more code context or adjust ignore settings.\n\n--- Linking Code Files in Your Response ---\nWhen you mention a [code] file, format it as a clickable link using the exact code file id without the "code:" prefix:\n  [DisplayText](coderef://root::relative/path/to/file)\nOnly use coderef:// for [code] files.`;
       }
     }
 
@@ -3054,9 +4604,13 @@ app.post("/api/code-line-ask", async (req, res) => {
       system,
       prompt: `File: ${filePath || "unknown"}\n\nHighlighted code:\n\`\`\`\n${selectedCode}\n\`\`\`\n\nQuestion: ${prompt.trim()}`,
       tools:
-        fileRegistry.size > 0
+        fileRegistry.size > 0 || scopedCodeContextFiles.length > 0
           ? {
-              readFile: createReadFileTool(fileRegistry),
+              ...(fileRegistry.size > 0
+                ? { readFile: createReadFileTool(fileRegistry) }
+                : {}),
+              ...createCodeContextTools(scopedCodeContextFiles),
+              ...createGitDiffTools(gitDiffContext || {}),
             }
           : undefined,
       stopWhen: stepCountIs(4),