create-interview-cockpit 0.25.0 → 0.26.1

package/template/server/src/index.ts

@@ -164,6 +164,7 @@ function makeCodeReferenceFileEntry(
 }
 
 interface GitDiffContextPayload {
+  rootId?: string;
   baseRef?: string;
   headRef?: string;
   mode?: string;
@@ -177,82 +178,56 @@ async function registerGitDiffContext(
   fileRegistry: Map<string, ReferenceFileEntry>,
   ctx: GitDiffContextPayload,
 ): Promise<string> {
-  if (!GIT_DIFF_DIR) return "";
-  const base = (ctx.baseRef || "").trim();
-  if (!base || !isValidRef(base)) return "";
-  const mode = parseDiffMode(ctx.mode);
-  const headRaw = (ctx.headRef || "").trim();
-  const head = mode === "working-tree" ? WORKING_TREE_SENTINEL : headRaw;
-  if (mode !== "working-tree" && (!head || !isValidRef(head))) return "";
-
-  const selected = Array.isArray(ctx.selectedFiles)
-    ? ctx.selectedFiles.filter(
-        (p) => typeof p === "string" && p && !p.includes("\0"),
-      )
-    : [];
-  if (selected.length === 0) return "";
-
-  let changedFiles: GitDiffFileEntry[];
-  try {
-    changedFiles = await getChangedFiles(base, head, mode);
-  } catch {
-    return "";
-  }
-  const byPath = new Map(changedFiles.map((f) => [f.path, f]));
-  const validSelected = selected.filter((p) => byPath.has(p));
-  if (validSelected.length === 0) return "";
-
-  const headLabel = mode === "working-tree" ? "working tree" : head;
-  const rangeLabel =
-    mode === "working-tree"
-      ? `${base} → working tree`
-      : `${base} ${mode === "two-dot" ? ".." : "..."} ${headLabel}`;
+  const scoped = await getScopedGitDiffContext(ctx);
+  if (!scoped) return "";
+  const { root, base, head, mode, entries, rangeLabel, headLabel } = scoped;
 
-  let manifest = `\n\n--- Available Git Diff Context (${rangeLabel}) ---
-You can pull lazy git diff context with the readFile tool. Three views are available per file:
-  • gitdiff:patch:<path>   — unified diff hunks (recommended starting point)
-  • gitdiff:before:<path>  — full file contents at the base ref
-  • gitdiff:after:<path>   — full file contents at the head ref (or working tree)
-Only read what you need; each file can be expensive.
+  let manifest = `\n\n--- Available Git Diff Context (${root.name}: ${rangeLabel}) ---
+You can inspect the selected changed files with the Git Diff tools or pull lazy views with readFile. Three views are available per file:
+  • gitdiff:patch:<root>::<path>   — unified diff hunks (recommended starting point)
+  • gitdiff:before:<root>::<path>  — full file contents at the base ref
+  • gitdiff:after:<root>::<path>   — full file contents at the head ref (or working tree)
+Use listGitDiffFiles to see selected diff files, readGitDiffFile to get patch/before/after, searchGitDiff to find specific changes, and summarizeGitDiff for totals. Only read what you need; each file can be expensive.
 
 `;
-  for (const filePath of validSelected) {
-    const entry = byPath.get(filePath)!;
+  for (const entry of entries) {
     const sign = entry.binary
       ? "binary"
       : `+${entry.additions}/-${entry.deletions}`;
     const renamed = entry.oldPath ? `  (renamed from ${entry.oldPath})` : "";
-    manifest += `• [${entry.status}] ${entry.path}  ${sign}${renamed}\n`;
-    manifest += `    patch id: "gitdiff:patch:${entry.path}"\n`;
+    manifest += `• [${entry.status}] ${entry.displayPath}  ${sign}${renamed}\n`;
+    manifest += `    patch id: "gitdiff:patch:${entry.id}"\n`;
     if (entry.status !== "A" && entry.status !== "?") {
-      manifest += `    before id: "gitdiff:before:${entry.path}"\n`;
+      manifest += `    before id: "gitdiff:before:${entry.id}"\n`;
     }
     if (entry.status !== "D") {
-      manifest += `    after id:  "gitdiff:after:${entry.path}"\n`;
+      manifest += `    after id:  "gitdiff:after:${entry.id}"\n`;
     }
 
-    const safePath = filePath; // already validated to be in diff
+    const safePath = entry.path; // already validated to be in diff
     fileRegistry.set(
-      `gitdiff:patch:${safePath}`,
-      makeCodeReferenceFileEntry(`[git diff] ${safePath}`, () =>
-        getDiffPatch(base, head, mode, safePath),
+      `gitdiff:patch:${entry.id}`,
+      makeCodeReferenceFileEntry(`[git diff:${root.name}] ${safePath}`, () =>
+        getDiffPatch(root, base, head, mode, safePath),
       ),
     );
     if (entry.status !== "A" && entry.status !== "?") {
       const refPath = entry.oldPath ?? safePath;
       fileRegistry.set(
-        `gitdiff:before:${safePath}`,
-        makeCodeReferenceFileEntry(`[git before ${base}] ${safePath}`, () =>
-          getFileAtRef(base, refPath),
+        `gitdiff:before:${entry.id}`,
+        makeCodeReferenceFileEntry(
+          `[git before ${base}:${root.name}] ${safePath}`,
+          () => getFileAtRef(root, base, refPath),
         ),
       );
     }
     if (entry.status !== "D") {
       const ref = mode === "working-tree" ? WORKING_TREE_SENTINEL : head;
       fileRegistry.set(
-        `gitdiff:after:${safePath}`,
-        makeCodeReferenceFileEntry(`[git after ${headLabel}] ${safePath}`, () =>
-          getFileAtRef(ref, safePath),
+        `gitdiff:after:${entry.id}`,
+        makeCodeReferenceFileEntry(
+          `[git after ${headLabel}:${root.name}] ${safePath}`,
+          () => getFileAtRef(root, ref, safePath),
         ),
       );
     }
@@ -344,7 +319,124 @@ function createReadFileTool(fileRegistry: Map<string, ReferenceFileEntry>) {
 }
 
 const PORT = process.env.PORT || 3001;
-const CODE_CONTEXT_DIR = process.env.CODE_CONTEXT_DIR || "";
+const CODE_CONTEXT_ROOT_SEPARATOR = "::";
+
+interface CodeContextRootConfig {
+  id: string;
+  name: string;
+  dir: string;
+}
+
+interface CodeContextFileRef {
+  id: string;
+  root: CodeContextRootConfig;
+  relPath: string;
+  absolutePath: string;
+}
+
+function splitCodeContextRootEnv(value: string | undefined): string[] {
+  if (!value) return [];
+  return value
+    .split(/[\n,;]/)
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+function parseCodeContextRootSpec(
+  raw: string,
+): { name?: string; dir: string } | null {
+  const value = raw.trim();
+  if (!value) return null;
+  const eq = value.indexOf("=");
+  if (eq > 0) {
+    const maybeName = value.slice(0, eq).trim();
+    const maybeDir = value.slice(eq + 1).trim();
+    if (maybeName && maybeDir && !/[\\/]/.test(maybeName)) {
+      return { name: maybeName, dir: path.resolve(maybeDir) };
+    }
+  }
+  return { dir: path.resolve(value) };
+}
+
+function slugForCodeContextRoot(value: string): string {
+  return (
+    value
+      .toLowerCase()
+      .replace(/[^a-z0-9._-]+/g, "-")
+      .replace(/^-+|-+$/g, "") || "root"
+  );
+}
+
+function uniqueCodeContextRootName(
+  baseName: string,
+  usedNames: Map<string, number>,
+): string {
+  const clean = baseName.trim() || "Code Context";
+  const key = clean.toLowerCase();
+  const count = usedNames.get(key) ?? 0;
+  usedNames.set(key, count + 1);
+  return count === 0 ? clean : `${clean} (${count + 1})`;
+}
+
+function uniqueCodeContextRootId(baseId: string, usedIds: Set<string>): string {
+  let candidate = baseId;
+  let suffix = 2;
+  while (usedIds.has(candidate)) {
+    candidate = `${baseId}-${suffix}`;
+    suffix += 1;
+  }
+  usedIds.add(candidate);
+  return candidate;
+}
+
+function resolveCodeContextRoots(): CodeContextRootConfig[] {
+  const specs = [
+    ...(process.env.CODE_CONTEXT_DIR
+      ? [
+          process.env.CODE_CONTEXT_NAME
+            ? `${process.env.CODE_CONTEXT_NAME}=${process.env.CODE_CONTEXT_DIR}`
+            : process.env.CODE_CONTEXT_DIR,
+        ]
+      : []),
+    ...splitCodeContextRootEnv(process.env.CODE_CONTEXT_DIRS),
+  ];
+  const seenDirs = new Set<string>();
+  const usedNames = new Map<string, number>();
+  const usedIds = new Set<string>();
+  const roots: CodeContextRootConfig[] = [];
+
+  for (const spec of specs) {
+    const parsed = parseCodeContextRootSpec(spec);
+    if (!parsed) continue;
+    const dir = path.resolve(parsed.dir);
+    if (seenDirs.has(dir)) continue;
+    seenDirs.add(dir);
+    const fallbackName = path.basename(dir) || "Code Context";
+    const name = uniqueCodeContextRootName(
+      parsed.name || fallbackName,
+      usedNames,
+    );
+    const id = uniqueCodeContextRootId(slugForCodeContextRoot(name), usedIds);
+    roots.push({ id, name, dir });
+  }
+
+  return roots;
+}
+
+const CODE_CONTEXT_ROOTS = resolveCodeContextRoots();
+const CODE_CONTEXT_ROOT_BY_ID = new Map(
+  CODE_CONTEXT_ROOTS.map((root) => [root.id, root]),
+);
+// Backward-compatible primary root used by git-diff config when GIT_DIFF_DIR is unset.
+const CODE_CONTEXT_DIR = CODE_CONTEXT_ROOTS[0]?.dir ?? "";
+
+function makeCodeContextFileId(rootId: string, relPath: string): string {
+  return `${rootId}${CODE_CONTEXT_ROOT_SEPARATOR}${relPath}`;
+}
+
+function getCodeContextPrimaryRoot(): CodeContextRootConfig | null {
+  return CODE_CONTEXT_ROOTS[0] ?? null;
+}
 
 const MAX_CODE_TOOL_LIST_RESULTS = 400;
 const MAX_CODE_TOOL_SEARCH_RESULTS = 80;
@@ -362,38 +454,106 @@ function normalizeCodeContextRelPath(value: string): string | null {
   return normalized;
 }
 
-function resolveCodeContextFilePath(relPath: string): string | null {
-  if (!CODE_CONTEXT_DIR) return null;
-  const normalized = normalizeCodeContextRelPath(relPath);
+function getCodeContextFileRef(
+  fileIdOrPath: string,
+): CodeContextFileRef | null {
+  if (CODE_CONTEXT_ROOTS.length === 0) return null;
+  const raw = fileIdOrPath.replaceAll("\\", "/").trim();
+  if (!raw || raw.includes("\0")) return null;
+
+  const sepIdx = raw.indexOf(CODE_CONTEXT_ROOT_SEPARATOR);
+  const root =
+    sepIdx > 0
+      ? CODE_CONTEXT_ROOT_BY_ID.get(raw.slice(0, sepIdx))
+      : getCodeContextPrimaryRoot();
+  const relRaw =
+    sepIdx > 0 ? raw.slice(sepIdx + CODE_CONTEXT_ROOT_SEPARATOR.length) : raw;
+  if (!root) return null;
+
+  const normalized = normalizeCodeContextRelPath(relRaw);
   if (!normalized || !isCodeContextPathAllowed(normalized)) return null;
 
-  const root = path.resolve(CODE_CONTEXT_DIR);
-  const resolved = path.resolve(root, normalized);
-  const relativeToRoot = path.relative(root, resolved);
+  const rootDir = path.resolve(root.dir);
+  const resolved = path.resolve(rootDir, normalized);
+  const relativeToRoot = path.relative(rootDir, resolved);
   if (relativeToRoot.startsWith("..") || path.isAbsolute(relativeToRoot)) {
     return null;
   }
-  return resolved;
+  return {
+    id: makeCodeContextFileId(root.id, normalized),
+    root,
+    relPath: normalized,
+    absolutePath: resolved,
+  };
+}
+
+function resolveCodeContextFilePath(fileIdOrPath: string): string | null {
+  return getCodeContextFileRef(fileIdOrPath)?.absolutePath ?? null;
+}
+
+function codeContextRelPath(fileIdOrPath: string): string {
+  return getCodeContextFileRef(fileIdOrPath)?.relPath ?? fileIdOrPath;
+}
+
+function codeContextDisplayPath(fileIdOrPath: string): string {
+  const ref = getCodeContextFileRef(fileIdOrPath);
+  if (!ref) return fileIdOrPath;
+  return `${ref.root.name}/${ref.relPath}`;
+}
+
+function codeContextFilterText(fileIdOrPath: string): string {
+  const ref = getCodeContextFileRef(fileIdOrPath);
+  if (!ref) return fileIdOrPath;
+  return `${ref.id} ${ref.root.name} ${ref.relPath}`;
+}
+
+async function getVisibleFilesForCodeContextRoot(
+  root: CodeContextRootConfig,
+): Promise<Set<string>> {
+  try {
+    return new Set(await walkDir(root.dir));
+  } catch {
+    return new Set();
+  }
+}
+
+async function getCodeContextRootsTree() {
+  const roots = [];
+  for (const root of CODE_CONTEXT_ROOTS) {
+    const files = [...(await getVisibleFilesForCodeContextRoot(root))].sort(
+      (a, b) => a.localeCompare(b),
+    );
+    roots.push({ id: root.id, name: root.name, files });
+  }
+  return { roots };
 }
 
 async function getScopedCodeContextFiles(
   selectedFiles: unknown,
 ): Promise<string[]> {
-  if (!CODE_CONTEXT_DIR || !Array.isArray(selectedFiles)) return [];
+  if (CODE_CONTEXT_ROOTS.length === 0 || !Array.isArray(selectedFiles)) {
+    return [];
+  }
 
   const selected = selectedFiles
     .filter((file): file is string => typeof file === "string")
-    .map((file) => normalizeCodeContextRelPath(file))
-    .filter((file): file is string => Boolean(file));
+    .map((file) => getCodeContextFileRef(file))
+    .filter((file): file is CodeContextFileRef => Boolean(file));
 
   if (selected.length === 0) return [];
 
-  try {
-    const visibleFiles = new Set(await walkDir(CODE_CONTEXT_DIR));
-    return uniqueStrings(selected).filter((file) => visibleFiles.has(file));
-  } catch {
-    return [];
+  const visibleByRoot = new Map<string, Set<string>>();
+  for (const root of CODE_CONTEXT_ROOTS.filter((root) =>
+    selected.some((file) => file.root.id === root.id),
+  )) {
+    visibleByRoot.set(root.id, await getVisibleFilesForCodeContextRoot(root));
   }
+
+  return uniqueStrings(
+    selected
+      .filter((file) => visibleByRoot.get(file.root.id)?.has(file.relPath))
+      .map((file) => file.id),
+  );
 }
 
 function escapeRegExp(value: string): string {
@@ -420,21 +580,31 @@ function trimToolLine(line: string): string {
 function codePathMatchesFilter(relPath: string, filter?: string): boolean {
   const normalizedFilter = filter?.trim().replaceAll("\\", "/").toLowerCase();
   if (!normalizedFilter) return true;
-  return relPath.toLowerCase().includes(normalizedFilter);
+  return codeContextFilterText(relPath)
+    .toLowerCase()
+    .includes(normalizedFilter);
 }
 
 function formatCodeFileTree(paths: string[], limit: number): string {
   const lines: string[] = [];
-  const seenDirs = new Set<string>();
-  for (const relPath of paths.slice(0, limit)) {
+  const seen = new Set<string>();
+  for (const fileId of paths.slice(0, limit)) {
+    const ref = getCodeContextFileRef(fileId);
+    const rootLabel = ref?.root.name ?? "Code Context";
+    const relPath = ref?.relPath ?? fileId;
+    const rootKey = `root:${rootLabel}`;
+    if (!seen.has(rootKey)) {
+      seen.add(rootKey);
+      lines.push(`${rootLabel}/`);
+    }
     const parts = relPath.split("/");
     for (let i = 0; i < parts.length - 1; i++) {
-      const dirPath = parts.slice(0, i + 1).join("/");
-      if (seenDirs.has(dirPath)) continue;
-      seenDirs.add(dirPath);
-      lines.push(`${"  ".repeat(i)}${parts[i]}/`);
+      const dirPath = `${rootLabel}:${parts.slice(0, i + 1).join("/")}`;
+      if (seen.has(dirPath)) continue;
+      seen.add(dirPath);
+      lines.push(`${"  ".repeat(i + 1)}${parts[i]}/`);
     }
-    lines.push(`${"  ".repeat(Math.max(0, parts.length - 1))}${parts.at(-1)}`);
+    lines.push(`${"  ".repeat(Math.max(1, parts.length))}${parts.at(-1)}`);
   }
   return lines.join("\n");
 }
@@ -502,6 +672,7 @@ async function searchCodeInFiles(
   );
   const matches: Array<{
     path: string;
+    displayPath: string;
     line: number;
     lineText: string;
     before: Array<{ line: number; text: string }>;
@@ -532,6 +703,7 @@ async function searchCodeInFiles(
       const afterEnd = Math.min(lines.length, i + contextLines + 1);
       matches.push({
         path: relPath,
+        displayPath: codeContextDisplayPath(relPath),
         line: i + 1,
         lineText: trimToolLine(lines[i]),
         before: lines.slice(beforeStart, i).map((text, offset) => ({
@@ -567,7 +739,7 @@ async function searchCodeInFiles(
 }
 
 function classifyConfigFile(relPath: string): string | null {
-  const lower = relPath.toLowerCase();
+  const lower = codeContextRelPath(relPath).toLowerCase();
   const base = lower.split("/").at(-1) || lower;
   if (/^\.github\/workflows\/.+\.ya?ml$/.test(lower)) {
     return "github-actions-workflow";
@@ -606,7 +778,8 @@ function classifyConfigFile(relPath: string): string | null {
 }
 
 function summarizeConfigStructure(relPath: string, content: string) {
-  const lower = relPath.toLowerCase();
+  const relativePath = codeContextRelPath(relPath);
+  const lower = relativePath.toLowerCase();
   if (lower.endsWith(".json")) {
     try {
       const parsed = JSON.parse(content);
@@ -628,7 +801,7 @@ function summarizeConfigStructure(relPath: string, content: string) {
     }
   }
 
-  if (/\.ya?ml$/i.test(relPath)) {
+  if (/\.ya?ml$/i.test(relativePath)) {
     const topLevelKeys = uniqueStrings(
       content
         .split(/\r?\n/)
@@ -638,7 +811,7 @@ function summarizeConfigStructure(relPath: string, content: string) {
     return { topLevelKeys };
   }
 
-  if (/\.(tf|tfvars|hcl)$/i.test(relPath)) {
+  if (/\.(tf|tfvars|hcl)$/i.test(relativePath)) {
     const blocks = uniqueStrings(
       content
         .split(/\r?\n/)
@@ -669,7 +842,8 @@ function extractConfigHighlights(content: string) {
 }
 
 function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
-  if (!CODE_CONTEXT_DIR || scopedCodeFiles.length === 0) return {};
+  if (CODE_CONTEXT_ROOTS.length === 0 || scopedCodeFiles.length === 0)
+    return {};
 
   const files = uniqueStrings(scopedCodeFiles).sort((a, b) =>
     a.localeCompare(b),
@@ -679,7 +853,7 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
   return {
     listCodeFiles: tool({
       description:
-        "List code-context files that are available to the model. This is read-only and restricted to files the user selected in Code Context, under CODE_CONTEXT_DIR, after ignore rules are applied.",
+        "List code-context files that are available to the model. This is read-only and restricted to files the user selected in Code Context, under configured code roots, after ignore rules are applied.",
       inputSchema: z.object({
         query: z
           .string()
@@ -719,6 +893,7 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
           totalMatched: filtered.length,
           truncated: filtered.length > listed.length,
           files: listed,
+          displayFiles: listed.map(codeContextDisplayPath),
           tree: formatCodeFileTree(listed, cappedLimit),
         };
       },
@@ -756,17 +931,20 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
     }),
     readCodeFile: tool({
       description:
-        "Read one available code-context file by relative path, optionally with a 1-based line range. Restricted to selected, non-ignored files.",
+        "Read one available code-context file by canonical path, optionally with a 1-based line range. Restricted to selected, non-ignored files.",
       inputSchema: z.object({
         path: z
           .string()
-          .describe("Relative path from the code context file list."),
+          .describe(
+            "Canonical path from listCodeFiles, e.g. root::src/file.ts. Legacy relative paths resolve against the first root.",
+          ),
         startLine: z.number().int().min(1).optional(),
         endLine: z.number().int().min(1).optional(),
       }),
       execute: async ({ path: requestedPath, startLine, endLine }) => {
-        const relPath = normalizeCodeContextRelPath(requestedPath || "");
-        if (!relPath || !fileSet.has(relPath)) {
+        const ref = getCodeContextFileRef(requestedPath || "");
+        const fileId = ref?.id;
+        if (!ref || !fileId || !fileSet.has(fileId)) {
           return {
             type: "error",
             error:
@@ -775,7 +953,7 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
         }
 
         try {
-          const read = await readCodeTextWithinLimit(relPath);
+          const read = await readCodeTextWithinLimit(fileId);
           const lines = read.content.split(/\r?\n/);
           const totalLines = lines.length;
           const first = clampNumber(startLine, 1, totalLines || 1, 1);
@@ -790,7 +968,8 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
             .map((line, index) => `${first + index}: ${line}`)
             .join("\n");
           return {
-            path: relPath,
+            path: fileId,
+            displayPath: codeContextDisplayPath(fileId),
             startLine: first,
             endLine: last,
             totalLines,
@@ -865,6 +1044,7 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
             const read = await readCodeTextWithinLimit(file);
             inspected.push({
               path: file,
+              displayPath: codeContextDisplayPath(file),
               kind,
               truncated: read.truncated,
               structure: summarizeConfigStructure(file, read.content),
@@ -873,6 +1053,7 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
           } catch (err: any) {
             inspected.push({
               path: file,
+              displayPath: codeContextDisplayPath(file),
               kind,
               error: err?.message || "Could not inspect file",
             });
@@ -934,8 +1115,12 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
         if (command === "pwd") {
           return {
             command: "pwd",
-            output: CODE_CONTEXT_DIR,
-            note: "Read-only tools are still restricted to selected, non-ignored code-context files.",
+            roots: CODE_CONTEXT_ROOTS.map((root) => ({
+              id: root.id,
+              name: root.name,
+              path: root.dir,
+            })),
+            note: "Read-only tools are still restricted to selected, non-ignored code-context files across these roots.",
           };
         }
         if (command === "find") {
@@ -949,6 +1134,7 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
           return {
             command: "find",
             files: filtered,
+            displayFiles: filtered.map(codeContextDisplayPath),
             truncated: filtered.length >= limit,
           };
         }
@@ -965,28 +1151,47 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
 
         if (command === "git-ls-files") {
           try {
-            const result = await runGit(["ls-files", "-z"], {
-              cwd: CODE_CONTEXT_DIR,
-              allowFail: true,
-              timeoutMs: 5000,
-              maxBuffer: 1024 * 1024,
-            });
-            if (result.code !== 0) {
-              return {
-                type: "error",
-                error: result.stderr.trim() || "git ls-files failed",
-              };
+            const matchingFiles: string[] = [];
+            const roots = CODE_CONTEXT_ROOTS.filter((root) =>
+              files.some(
+                (file) => getCodeContextFileRef(file)?.root.id === root.id,
+              ),
+            );
+            const errors: string[] = [];
+
+            for (const root of roots) {
+              const result = await runGit(["ls-files", "-z"], {
+                cwd: root.dir,
+                allowFail: true,
+                timeoutMs: 5000,
+                maxBuffer: 1024 * 1024,
+              });
+              if (result.code !== 0) {
+                errors.push(
+                  `${root.name}: ${result.stderr.trim() || "git ls-files failed"}`,
+                );
+                continue;
+              }
+              const tracked = new Set(
+                result.stdout.split("\0").filter(Boolean),
+              );
+              for (const file of files) {
+                const ref = getCodeContextFileRef(file);
+                if (ref?.root.id !== root.id) continue;
+                if (
+                  tracked.has(ref.relPath) &&
+                  codePathMatchesFilter(file, pathFilter)
+                ) {
+                  matchingFiles.push(file);
+                }
+              }
             }
-            const tracked = new Set(result.stdout.split("\0").filter(Boolean));
-            const filtered = files
-              .filter(
-                (file) =>
-                  tracked.has(file) && codePathMatchesFilter(file, pathFilter),
-              )
-              .slice(0, limit);
+            const filtered = matchingFiles.slice(0, limit);
             return {
               command: "git ls-files",
               files: filtered,
+              displayFiles: filtered.map(codeContextDisplayPath),
+              errors,
               truncated: filtered.length >= limit,
             };
           } catch (err: any) {
@@ -997,8 +1202,9 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
           }
         }
 
-        const relPath = normalizeCodeContextRelPath(requestedPath || "");
-        if (!relPath || !fileSet.has(relPath)) {
+        const fileRef = getCodeContextFileRef(requestedPath || "");
+        const fileId = fileRef?.id;
+        if (!fileRef || !fileId || !fileSet.has(fileId)) {
           return {
             type: "error",
             error:
@@ -1015,10 +1221,10 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
                 "--decorate",
                 `--max-count=${Math.min(limit, 50)}`,
                 "--",
-                relPath,
+                fileRef.relPath,
               ],
               {
-                cwd: CODE_CONTEXT_DIR,
+                cwd: fileRef.root.dir,
                 allowFail: true,
                 timeoutMs: 5000,
                 maxBuffer: 512 * 1024,
@@ -1026,7 +1232,8 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
             );
             return {
               command: "git log",
-              path: relPath,
+              path: fileId,
+              displayPath: codeContextDisplayPath(fileId),
               output:
                 result.stdout.trim() ||
                 result.stderr.trim() ||
@@ -1044,16 +1251,17 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
             const last = Math.max(first, endLine ?? first);
             args.push("-L", `${first},${last}`);
           }
-          args.push("--", relPath);
+          args.push("--", fileRef.relPath);
           const result = await runGit(args, {
-            cwd: CODE_CONTEXT_DIR,
+            cwd: fileRef.root.dir,
             allowFail: true,
             timeoutMs: 5000,
             maxBuffer: 512 * 1024,
           });
           return {
             command: "git blame",
-            path: relPath,
+            path: fileId,
+            displayPath: codeContextDisplayPath(fileId),
             output:
               result.stdout.trim() ||
               result.stderr.trim() ||
@@ -1067,6 +1275,280 @@ function createCodeContextTools(scopedCodeFiles: string[]): ToolSet {
   };
 }
 
+function createGitDiffTools(ctx: GitDiffContextPayload): ToolSet {
+  if (
+    GIT_DIFF_ROOTS.length === 0 ||
+    !Array.isArray(ctx.selectedFiles) ||
+    ctx.selectedFiles.length === 0
+  ) {
+    return {};
+  }
+
+  async function loadScoped() {
+    const scoped = await getScopedGitDiffContext(ctx);
+    if (!scoped) {
+      throw new Error(
+        "No selected git diff files are available for this root/range.",
+      );
+    }
+    return scoped;
+  }
+
+  function formatEntry(entry: ScopedGitDiffEntry) {
+    return {
+      path: entry.id,
+      displayPath: entry.displayPath,
+      relativePath: entry.path,
+      oldPath: entry.oldPath,
+      status: entry.status,
+      additions: entry.additions,
+      deletions: entry.deletions,
+      binary: entry.binary,
+    };
+  }
+
+  return {
+    listGitDiffFiles: tool({
+      description:
+        "List selected git diff files for the configured diff root/range. Restricted to files the user selected in Git Diff context.",
+      inputSchema: z.object({
+        query: z
+          .string()
+          .optional()
+          .describe("Optional case-insensitive path/root/status filter."),
+        status: z
+          .enum(["A", "M", "D", "R", "C", "T", "U", "?"])
+          .optional()
+          .describe("Optional git status filter."),
+        limit: z.number().int().min(1).max(500).optional(),
+      }),
+      execute: async ({ query, status, limit }) => {
+        try {
+          const scoped = await loadScoped();
+          const filter = query?.trim().toLowerCase();
+          const cappedLimit = clampNumber(limit, 1, 500, 200);
+          const matched = scoped.entries.filter((entry) => {
+            if (status && entry.status !== status) return false;
+            if (!filter) return true;
+            return `${entry.id} ${entry.displayPath} ${entry.status}`
+              .toLowerCase()
+              .includes(filter);
+          });
+          return {
+            root: {
+              id: scoped.root.id,
+              name: scoped.root.name,
+            },
+            range: scoped.rangeLabel,
+            totalSelected: scoped.entries.length,
+            totalMatched: matched.length,
+            truncated: matched.length > cappedLimit,
+            files: matched.slice(0, cappedLimit).map(formatEntry),
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "diff list failed" };
+        }
+      },
+    }),
+    readGitDiffFile: tool({
+      description:
+        "Read a selected git diff file as a patch, before blob, or after blob. Use patch for exact changed hunks; use before/after to compare full file versions.",
+      inputSchema: z.object({
+        path: z
+          .string()
+          .describe(
+            "Canonical path from listGitDiffFiles, e.g. root::src/file.ts. Legacy relative paths resolve against the selected diff root.",
+          ),
+        view: z
+          .enum(["patch", "before", "after"])
+          .optional()
+          .describe("Which diff view to read. Defaults to patch."),
+        startLine: z.number().int().min(1).optional(),
+        endLine: z.number().int().min(1).optional(),
+      }),
+      execute: async ({ path: requestedPath, view, startLine, endLine }) => {
+        try {
+          const scoped = await loadScoped();
+          const entry = findScopedGitDiffEntry(scoped, requestedPath);
+          if (!entry) {
+            return {
+              type: "error",
+              error: "File is not in the selected git diff context.",
+            };
+          }
+          const selectedView = view ?? "patch";
+          const content = await readGitDiffView(scoped, entry, selectedView);
+          const lines = content.split(/\r?\n/);
+          const totalLines = lines.length;
+          const first = clampNumber(startLine, 1, totalLines || 1, 1);
+          const last = clampNumber(
+            endLine,
+            first,
+            totalLines || first,
+            totalLines || first,
+          );
+          const selectedLines = lines
+            .slice(first - 1, last)
+            .map((line, index) => `${first + index}: ${line}`)
+            .join("\n");
+          return {
+            path: entry.id,
+            displayPath: entry.displayPath,
+            view: selectedView,
+            status: entry.status,
+            startLine: first,
+            endLine: last,
+            totalLines,
+            content: selectedLines || "(empty)",
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "diff read failed" };
+        }
+      },
+    }),
+    searchGitDiff: tool({
+      description:
+        "Search selected git diff patches and/or before/after blobs for exact text or a regular expression. Useful for finding specific changed symbols, config keys, or hunks.",
+      inputSchema: z.object({
+        query: z.string().min(1),
+        view: z
+          .enum(["patch", "before", "after", "all"])
+          .optional()
+          .describe("Which view to search. Defaults to patch."),
+        regex: z.boolean().optional(),
+        caseSensitive: z.boolean().optional(),
+        pathFilter: z.string().optional(),
+        limit: z.number().int().min(1).max(200).optional(),
+      }),
+      execute: async ({
+        query,
+        view,
+        regex,
+        caseSensitive,
+        pathFilter,
+        limit,
+      }) => {
+        try {
+          const scoped = await loadScoped();
+          const cappedLimit = clampNumber(limit, 1, 200, 80);
+          const selectedView = view ?? "patch";
+          const flags = caseSensitive ? "" : "i";
+          const pattern = new RegExp(
+            regex ? query : escapeRegExp(query),
+            flags,
+          );
+          const filter = pathFilter?.trim().toLowerCase();
+          const views =
+            selectedView === "all"
+              ? (["patch", "before", "after"] as const)
+              : ([selectedView] as const);
+          const matches: Array<{
+            path: string;
+            displayPath: string;
+            view: "patch" | "before" | "after";
+            line: number;
+            lineText: string;
+          }> = [];
+
+          for (const entry of scoped.entries) {
+            if (
+              filter &&
+              !`${entry.id} ${entry.displayPath}`.toLowerCase().includes(filter)
+            ) {
+              continue;
+            }
+            for (const currentView of views) {
+              if (
+                currentView === "before" &&
+                (entry.status === "A" || entry.status === "?")
+              ) {
+                continue;
+              }
+              if (currentView === "after" && entry.status === "D") {
+                continue;
+              }
+              const content = await readGitDiffView(scoped, entry, currentView);
+              const lines = content.split(/\r?\n/);
+              for (let i = 0; i < lines.length; i += 1) {
+                pattern.lastIndex = 0;
+                if (!pattern.test(lines[i])) continue;
+                matches.push({
+                  path: entry.id,
+                  displayPath: entry.displayPath,
+                  view: currentView,
+                  line: i + 1,
+                  lineText: trimToolLine(lines[i]),
+                });
+                if (matches.length >= cappedLimit) {
+                  return {
+                    query,
+                    view: selectedView,
+                    totalMatches: matches.length,
+                    truncated: true,
+                    matches,
+                  };
+                }
+              }
+            }
+          }
+
+          return {
+            query,
+            view: selectedView,
+            totalMatches: matches.length,
+            truncated: false,
+            matches,
+          };
+        } catch (err: any) {
+          return { type: "error", error: err?.message || "diff search failed" };
+        }
+      },
+    }),
+    summarizeGitDiff: tool({
+      description:
+        "Summarize the selected git diff context with totals by status and additions/deletions. Use this before deeper reads when multiple files are selected.",
+      inputSchema: z.object({
+        includeFiles: z.boolean().optional(),
+      }),
+      execute: async ({ includeFiles }) => {
+        try {
+          const scoped = await loadScoped();
+          const byStatus: Record<string, number> = {};
+          let additions = 0;
+          let deletions = 0;
+          let binaryFiles = 0;
+          for (const entry of scoped.entries) {
+            byStatus[entry.status] = (byStatus[entry.status] ?? 0) + 1;
+            additions += entry.additions;
+            deletions += entry.deletions;
+            if (entry.binary) binaryFiles += 1;
+          }
+          return {
+            root: {
+              id: scoped.root.id,
+              name: scoped.root.name,
+            },
+            range: scoped.rangeLabel,
+            filesChanged: scoped.entries.length,
+            additions,
+            deletions,
+            binaryFiles,
+            byStatus,
+            ...(includeFiles
+              ? { files: scoped.entries.map(formatEntry).slice(0, 200) }
+              : {}),
+          };
+        } catch (err: any) {
+          return {
+            type: "error",
+            error: err?.message || "diff summary failed",
+          };
+        }
+      },
+    }),
+  };
+}
+
 // ─── AI Providers (Vercel AI SDK) ────────────────────────
 // Set the provider + model in .env. Supports: openai, google, anthropic
 
@@ -1720,6 +2202,7 @@ app.patch("/api/questions/:id", async (req, res) => {
       delete q.gitDiffContext;
     } else if (gdc && typeof gdc === "object") {
       q.gitDiffContext = {
+        rootId: String(gdc.rootId || ""),
         baseRef: String(gdc.baseRef || ""),
         headRef: String(gdc.headRef || ""),
         mode:
@@ -2710,14 +3193,15 @@ app.post("/api/chat", async (req, res) => {
     await getScopedCodeContextFiles(codeContextFiles);
 
   // Code-context files from the project directory
-  if (scopedCodeContextFiles.length && CODE_CONTEXT_DIR) {
+  if (scopedCodeContextFiles.length && CODE_CONTEXT_ROOTS.length > 0) {
     for (const filePath of scopedCodeContextFiles) {
-      const resolved = resolveCodeContextFilePath(filePath);
-      if (!resolved) continue;
+      const ref = getCodeContextFileRef(filePath);
+      if (!ref) continue;
       fileRegistry.set(
         `code:${filePath}`,
-        makeCodeReferenceFileEntry(`[code] ${filePath}`, () =>
-          fs.readFile(resolved, "utf-8"),
+        makeCodeReferenceFileEntry(
+          `[code:${ref.root.name}] ${ref.relPath}`,
+          () => fs.readFile(ref.absolutePath, "utf-8"),
         ),
       );
     }
@@ -2762,18 +3246,18 @@ You also have read-only code tools for the selected Code Context files:
 - inspectCiConfig: summarize CI/CD, package, Docker, and Terraform config among selected files.
 - runReadOnlyCodeCommand: safe whitelisted equivalents for pwd/find/rg/git-ls-files/git-log/git-blame.
 
-These tools cannot access files outside CODE_CONTEXT_DIR, files hidden by ignore rules, or files the user did not select. If something is missing, ask the user to select more code context or adjust ignore settings.
+These tools cannot access files outside the configured code-context roots, files hidden by ignore rules, or files the user did not select. File IDs are root-qualified like "root::relative/path". If something is missing, ask the user to select more code context or adjust ignore settings.
 
 --- Linking Code Files in Your Response ---
 When you mention or reference one of the **[code]** files above in your response text, format it as a clickable link so the user can open it directly:
 
-  [DisplayText](coderef://relative/path/to/file)
+  [DisplayText](coderef://root::relative/path/to/file)
 
 Examples:
-  [EmployeesController](coderef://src/Controllers/EmployeesController.cs)
-  [SettleDeferredPaymentCaseRequest](coderef://src/Requests/SettleDeferredPaymentCaseRequest.cs)
+  [EmployeesController](coderef://backend::src/Controllers/EmployeesController.cs)
+  [SettleDeferredPaymentCaseRequest](coderef://api::src/Requests/SettleDeferredPaymentCaseRequest.cs)
 
-Use this for class names, method names, or any mention of a specific file from the code context. The display text should be the class, file, or concept name — not the raw path.
+Use this for class names, method names, or any mention of a specific file from the code context. The href must use the exact code file id shown above without the "code:" prefix. The display text should be the class, file, or concept name — not the raw path.
 Only use coderef:// for [code] files. Do not use it for uploaded documents.`;
     }
 
@@ -2896,6 +3380,7 @@ Examples (illustrative only — use real ids and names from the list above):
             }
           : {}),
         ...createCodeContextTools(scopedCodeContextFiles),
+        ...createGitDiffTools(gitDiffContext || {}),
       },
       stopWhen: stepCountIs(selectedResponseProfile.maxSteps),
     });
@@ -3134,30 +3619,34 @@ async function walkDir(dir: string, prefix = ""): Promise<string[]> {
 }
 
 app.get("/api/code-context/tree", async (_req, res) => {
-  if (!CODE_CONTEXT_DIR) return res.json([]);
+  if (CODE_CONTEXT_ROOTS.length === 0) return res.json({ roots: [] });
   try {
-    const files = await walkDir(CODE_CONTEXT_DIR);
-    res.json(files);
+    res.json(await getCodeContextRootsTree());
   } catch {
-    res.json([]);
+    res.json({ roots: [] });
   }
 });
 
 app.get("/api/code-context/file", async (req, res) => {
-  if (!CODE_CONTEXT_DIR)
-    return res.status(400).json({ error: "No code context directory" });
+  if (CODE_CONTEXT_ROOTS.length === 0)
+    return res.status(400).json({ error: "No code context roots" });
   const filePath = req.query.path as string;
   if (!filePath) return res.status(400).json({ error: "Path required" });
 
-  const normalized = normalizeCodeContextRelPath(filePath);
-  const resolved = normalized ? resolveCodeContextFilePath(normalized) : null;
-  if (!normalized || !resolved) {
+  const ref = getCodeContextFileRef(filePath);
+  if (!ref) {
     return res.status(403).json({ error: "Access denied" });
   }
 
   try {
-    const content = await fs.readFile(resolved, "utf-8");
-    res.json({ path: normalized, content });
+    const content = await fs.readFile(ref.absolutePath, "utf-8");
+    res.json({
+      path: ref.id,
+      rootId: ref.root.id,
+      rootName: ref.root.name,
+      relativePath: ref.relPath,
+      content,
+    });
   } catch {
     res.status(404).json({ error: "File not found" });
   }
@@ -3170,7 +3659,108 @@ app.get("/api/code-context/file", async (req, res) => {
 // or before/after blobs are pulled lazily via the readFile tool using ids of
 // the form  gitdiff:patch:<path> / gitdiff:before:<path> / gitdiff:after:<path>.
 
-const GIT_DIFF_DIR = process.env.GIT_DIFF_DIR || CODE_CONTEXT_DIR;
+function resolveGitDiffRoots(): CodeContextRootConfig[] {
+  const specs = [
+    ...(process.env.GIT_DIFF_DIR
+      ? [
+          process.env.GIT_DIFF_NAME
+            ? `${process.env.GIT_DIFF_NAME}=${process.env.GIT_DIFF_DIR}`
+            : process.env.GIT_DIFF_DIR,
+        ]
+      : []),
+    ...splitCodeContextRootEnv(process.env.GIT_DIFF_DIRS),
+  ];
+
+  if (specs.length === 0) {
+    return CODE_CONTEXT_ROOTS.map((root) => ({ ...root }));
+  }
+
+  const seenDirs = new Set<string>();
+  const usedNames = new Map<string, number>();
+  const usedIds = new Set<string>();
+  const roots: CodeContextRootConfig[] = [];
+
+  for (const spec of specs) {
+    const parsed = parseCodeContextRootSpec(spec);
+    if (!parsed) continue;
+    const dir = path.resolve(parsed.dir);
+    if (seenDirs.has(dir)) continue;
+    seenDirs.add(dir);
+    const fallbackName = path.basename(dir) || "Git Diff";
+    const name = uniqueCodeContextRootName(
+      parsed.name || fallbackName,
+      usedNames,
+    );
+    const id = uniqueCodeContextRootId(slugForCodeContextRoot(name), usedIds);
+    roots.push({ id, name, dir });
+  }
+
+  return roots;
+}
+
+const GIT_DIFF_ROOTS = resolveGitDiffRoots();
+const GIT_DIFF_ROOT_BY_ID = new Map(
+  GIT_DIFF_ROOTS.map((root) => [root.id, root]),
+);
+const GIT_DIFF_DIR = GIT_DIFF_ROOTS[0]?.dir ?? "";
+
+function getGitDiffPrimaryRoot(): CodeContextRootConfig | null {
+  return GIT_DIFF_ROOTS[0] ?? null;
+}
+
+function getGitDiffRoot(rootId?: string | null): CodeContextRootConfig | null {
+  const normalized = rootId?.trim();
+  if (normalized) return GIT_DIFF_ROOT_BY_ID.get(normalized) ?? null;
+  return getGitDiffPrimaryRoot();
+}
+
+function makeGitDiffFileId(rootId: string, relPath: string): string {
+  return `${rootId}${CODE_CONTEXT_ROOT_SEPARATOR}${relPath}`;
+}
+
+interface GitDiffFileRef {
+  id: string;
+  root: CodeContextRootConfig;
+  relPath: string;
+}
+
+function getGitDiffFileRef(
+  fileIdOrPath: string,
+  fallbackRootId?: string,
+): GitDiffFileRef | null {
+  if (GIT_DIFF_ROOTS.length === 0) return null;
+  const raw = fileIdOrPath
+    .replace(/^gitdiff:(patch|before|after):/, "")
+    .replaceAll("\\", "/")
+    .trim();
+  if (!raw || raw.includes("\0")) return null;
+
+  const sepIdx = raw.indexOf(CODE_CONTEXT_ROOT_SEPARATOR);
+  const root =
+    sepIdx > 0
+      ? GIT_DIFF_ROOT_BY_ID.get(raw.slice(0, sepIdx))
+      : getGitDiffRoot(fallbackRootId);
+  const relRaw =
+    sepIdx > 0 ? raw.slice(sepIdx + CODE_CONTEXT_ROOT_SEPARATOR.length) : raw;
+  if (!root) return null;
+
+  const normalized = normalizeCodeContextRelPath(relRaw);
+  if (!normalized || !isCodeContextPathAllowed(normalized)) return null;
+
+  return {
+    id: makeGitDiffFileId(root.id, normalized),
+    root,
+    relPath: normalized,
+  };
+}
+
+function getGitDiffRootSummaries() {
+  return GIT_DIFF_ROOTS.map((root) => ({
+    id: root.id,
+    name: root.name,
+    path: root.dir,
+  }));
+}
 
 // Hard caps so a runaway repo can never blow up the response or the model's context.
 const MAX_DIFF_FILES = 500;
@@ -3191,6 +3781,21 @@ interface GitDiffFileEntry {
   binary: boolean;
 }
 
+interface ScopedGitDiffEntry extends GitDiffFileEntry {
+  id: string;
+  displayPath: string;
+}
+
+interface ScopedGitDiffContext {
+  root: CodeContextRootConfig;
+  base: string;
+  head: string;
+  headLabel: string;
+  mode: GitDiffMode;
+  rangeLabel: string;
+  entries: ScopedGitDiffEntry[];
+}
+
 function runGit(
   args: string[],
   opts: {
@@ -3277,13 +3882,16 @@ function isValidRef(ref: string): boolean {
   return REF_PATTERN.test(ref);
 }
 
-async function resolveRef(ref: string): Promise<string | null> {
+async function resolveRef(
+  root: CodeContextRootConfig,
+  ref: string,
+): Promise<string | null> {
   if (!isValidRef(ref)) return null;
   try {
     const { stdout } = await runGit(
       ["rev-parse", "--verify", `${ref}^{commit}`],
       {
-        cwd: GIT_DIFF_DIR,
+        cwd: root.dir,
       },
     );
     return stdout.trim() || null;
@@ -3314,6 +3922,7 @@ function buildDiffRange(
 }
 
 async function getChangedFiles(
+  root: CodeContextRootConfig,
   base: string,
   head: string,
   mode: GitDiffMode,
@@ -3323,10 +3932,10 @@ async function getChangedFiles(
 
   const nameStatus = await runGit(
     [...baseArgs, "--name-status", "-z", ...range],
-    { cwd: GIT_DIFF_DIR },
+    { cwd: root.dir },
   );
   const numStat = await runGit([...baseArgs, "--numstat", "-z", ...range], {
-    cwd: GIT_DIFF_DIR,
+    cwd: root.dir,
   });
 
   // numstat with -z uses NUL between records AND between additions/deletions/path,
@@ -3384,7 +3993,7 @@ async function getChangedFiles(
     try {
       const untracked = await runGit(
         ["ls-files", "--others", "--exclude-standard", "-z"],
-        { cwd: GIT_DIFF_DIR },
+        { cwd: root.dir },
       );
       for (const filePath of untracked.stdout
         .split("\0")
@@ -3402,10 +4011,17 @@ async function getChangedFiles(
     }
   }
 
-  return entries.slice(0, MAX_DIFF_FILES);
+  return entries
+    .filter(
+      (entry) =>
+        isCodeContextPathAllowed(entry.path) &&
+        (!entry.oldPath || isCodeContextPathAllowed(entry.oldPath)),
+    )
+    .slice(0, MAX_DIFF_FILES);
 }
 
 async function getDiffPatch(
+  root: CodeContextRootConfig,
   base: string,
   head: string,
   mode: GitDiffMode,
@@ -3422,7 +4038,7 @@ async function getDiffPatch(
       "--",
       filePath,
     ],
-    { cwd: GIT_DIFF_DIR, maxBuffer: MAX_DIFF_FILE_BYTES * 4 },
+    { cwd: root.dir, maxBuffer: MAX_DIFF_FILE_BYTES * 4 },
   );
   if (stdout.length > MAX_DIFF_FILE_BYTES) {
     return (
@@ -3433,10 +4049,16 @@ async function getDiffPatch(
   return stdout;
 }
 
-async function getFileAtRef(ref: string, filePath: string): Promise<string> {
+async function getFileAtRef(
+  root: CodeContextRootConfig,
+  ref: string,
+  filePath: string,
+): Promise<string> {
   if (ref === WORKING_TREE_SENTINEL) {
-    const resolved = path.resolve(path.join(GIT_DIFF_DIR, filePath));
-    if (!resolved.startsWith(path.resolve(GIT_DIFF_DIR))) {
+    const rootDir = path.resolve(root.dir);
+    const resolved = path.resolve(path.join(rootDir, filePath));
+    const relativeToRoot = path.relative(rootDir, resolved);
+    if (relativeToRoot.startsWith("..") || path.isAbsolute(relativeToRoot)) {
       throw new Error("Access denied");
     }
     const buf = await fs.readFile(resolved);
@@ -3449,7 +4071,7 @@ async function getFileAtRef(ref: string, filePath: string): Promise<string> {
     return buf.toString("utf-8");
   }
   const { stdout } = await runGit(["show", `${ref}:${filePath}`], {
-    cwd: GIT_DIFF_DIR,
+    cwd: root.dir,
     maxBuffer: MAX_DIFF_FILE_BYTES * 4,
   });
   if (stdout.length > MAX_DIFF_FILE_BYTES) {
@@ -3461,92 +4083,224 @@ async function getFileAtRef(ref: string, filePath: string): Promise<string> {
   return stdout;
 }
 
-app.get("/api/code-context/git/branches", async (_req, res) => {
-  if (!GIT_DIFF_DIR) return res.json({ enabled: false, branches: [] });
+async function getScopedGitDiffContext(
+  ctx: GitDiffContextPayload,
+): Promise<ScopedGitDiffContext | null> {
+  if (GIT_DIFF_ROOTS.length === 0) return null;
+  const selectedRaw = Array.isArray(ctx.selectedFiles)
+    ? ctx.selectedFiles.filter((p): p is string => typeof p === "string")
+    : [];
+  const inferredRootId =
+    ctx.rootId ||
+    selectedRaw
+      .map((p) => getGitDiffFileRef(p)?.root.id)
+      .find((id): id is string => Boolean(id));
+  const root = getGitDiffRoot(inferredRootId || null);
+  if (!root) return null;
+
+  const base = (ctx.baseRef || "").trim();
+  if (!base || !isValidRef(base)) return null;
+  const mode = parseDiffMode(ctx.mode);
+  const headRaw = (ctx.headRef || "").trim();
+  const head = mode === "working-tree" ? WORKING_TREE_SENTINEL : headRaw;
+  if (mode !== "working-tree" && (!head || !isValidRef(head))) return null;
+
+  const selectedRefs = selectedRaw
+    .map((p) => getGitDiffFileRef(p, root.id))
+    .filter((p): p is GitDiffFileRef => Boolean(p))
+    .filter((p) => p.root.id === root.id);
+  if (selectedRefs.length === 0) return null;
+
+  let changedFiles: GitDiffFileEntry[];
   try {
-    // Refresh remote-tracking refs first. This is intentionally non-interactive
-    // and time-capped so private/offline repos fall back to already-local refs.
-    await runGit(["fetch", "--all", "--prune", "--quiet"], {
-      cwd: GIT_DIFF_DIR,
-      allowFail: true,
-      timeoutMs: 8000,
-    });
+    changedFiles = await getChangedFiles(root, base, head, mode);
+  } catch {
+    return null;
+  }
+  const byPath = new Map(changedFiles.map((f) => [f.path, f]));
+  const selectedPaths = uniqueStrings(selectedRefs.map((ref) => ref.relPath));
+  const entries = selectedPaths
+    .map((relPath) => byPath.get(relPath))
+    .filter((entry): entry is GitDiffFileEntry => Boolean(entry))
+    .map((entry) => ({
+      ...entry,
+      id: makeGitDiffFileId(root.id, entry.path),
+      displayPath: `${root.name}/${entry.path}`,
+    }));
+  if (entries.length === 0) return null;
 
-    const [head, branches, tags, remotes] = await Promise.all([
-      runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: GIT_DIFF_DIR }),
-      runGit(
-        [
-          "for-each-ref",
-          "--sort=-committerdate",
-          `--count=${MAX_BRANCHES}`,
-          "--format=%(refname:short)",
-          "refs/heads/",
-          "refs/remotes/",
-        ],
-        { cwd: GIT_DIFF_DIR },
-      ),
-      runGit(
-        [
-          "for-each-ref",
-          "--sort=-creatordate",
-          "--count=50",
-          "--format=%(refname:short)",
-          "refs/tags/",
-        ],
-        { cwd: GIT_DIFF_DIR, allowFail: true },
-      ),
-      runGit(["remote"], { cwd: GIT_DIFF_DIR, allowFail: true }),
-    ]);
-    const remoteNames = remotes.stdout
-      .split("\n")
-      .map((s) => s.trim())
-      .filter(Boolean);
-    const lsRemoteResults = await Promise.all(
-      remoteNames.slice(0, 5).map((remote) =>
-        runGit(["ls-remote", "--heads", remote], {
-          cwd: GIT_DIFF_DIR,
-          allowFail: true,
-          timeoutMs: 5000,
-          maxBuffer: 1024 * 1024,
-        }).then((result) =>
-          result.stdout
-            .split("\n")
-            .map((line) => line.trim().split("\t")[1] || "")
-            .filter((ref) => ref.startsWith("refs/heads/"))
-            .map((ref) => `${remote}/${ref.replace("refs/heads/", "")}`),
-        ),
+  const headLabel = mode === "working-tree" ? "working tree" : head;
+  const rangeLabel =
+    mode === "working-tree"
+      ? `${base} → working tree`
+      : `${base} ${mode === "two-dot" ? ".." : "..."} ${headLabel}`;
+
+  return {
+    root,
+    base,
+    head,
+    headLabel,
+    mode,
+    rangeLabel,
+    entries,
+  };
+}
+
+function findScopedGitDiffEntry(
+  scoped: ScopedGitDiffContext,
+  fileIdOrPath: string,
+): ScopedGitDiffEntry | null {
+  const ref = getGitDiffFileRef(fileIdOrPath, scoped.root.id);
+  if (!ref || ref.root.id !== scoped.root.id) return null;
+  return (
+    scoped.entries.find(
+      (entry) => entry.id === ref.id || entry.path === ref.relPath,
+    ) ?? null
+  );
+}
+
+async function readGitDiffView(
+  scoped: ScopedGitDiffContext,
+  entry: ScopedGitDiffEntry,
+  view: "patch" | "before" | "after",
+): Promise<string> {
+  if (view === "before") {
+    if (entry.status === "A" || entry.status === "?") return "";
+    return getFileAtRef(scoped.root, scoped.base, entry.oldPath ?? entry.path);
+  }
+  if (view === "after") {
+    if (entry.status === "D") return "";
+    const ref =
+      scoped.mode === "working-tree" ? WORKING_TREE_SENTINEL : scoped.head;
+    return getFileAtRef(scoped.root, ref, entry.path);
+  }
+  return getDiffPatch(
+    scoped.root,
+    scoped.base,
+    scoped.head,
+    scoped.mode,
+    entry.path,
+  );
+}
+
+async function loadGitBranchesForRoot(root: CodeContextRootConfig) {
+  // Refresh remote-tracking refs first. This is intentionally non-interactive
+  // and time-capped so private/offline repos fall back to already-local refs.
+  await runGit(["fetch", "--all", "--prune", "--quiet"], {
+    cwd: root.dir,
+    allowFail: true,
+    timeoutMs: 8000,
+  });
+
+  const [head, branches, tags, remotes] = await Promise.all([
+    runGit(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: root.dir }),
+    runGit(
+      [
+        "for-each-ref",
+        "--sort=-committerdate",
+        `--count=${MAX_BRANCHES}`,
+        "--format=%(refname:short)",
+        "refs/heads/",
+        "refs/remotes/",
+      ],
+      { cwd: root.dir },
+    ),
+    runGit(
+      [
+        "for-each-ref",
+        "--sort=-creatordate",
+        "--count=50",
+        "--format=%(refname:short)",
+        "refs/tags/",
+      ],
+      { cwd: root.dir, allowFail: true },
+    ),
+    runGit(["remote"], { cwd: root.dir, allowFail: true }),
+  ]);
+  const remoteNames = remotes.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const lsRemoteResults = await Promise.all(
+    remoteNames.slice(0, 5).map((remote) =>
+      runGit(["ls-remote", "--heads", remote], {
+        cwd: root.dir,
+        allowFail: true,
+        timeoutMs: 5000,
+        maxBuffer: 1024 * 1024,
+      }).then((result) =>
+        result.stdout
+          .split("\n")
+          .map((line) => line.trim().split("\t")[1] || "")
+          .filter((ref) => ref.startsWith("refs/heads/"))
+          .map((ref) => `${remote}/${ref.replace("refs/heads/", "")}`),
       ),
-    );
-    const branchList = uniqueStrings([
-      ...branches.stdout
-        .split("\n")
-        .map((s) => s.trim())
-        .filter(Boolean),
-      ...lsRemoteResults.flat(),
-    ]).filter((b) => !b.endsWith("/HEAD"));
-    const tagList = tags.stdout
+    ),
+  );
+  const branchList = uniqueStrings([
+    ...branches.stdout
       .split("\n")
       .map((s) => s.trim())
-      .filter(Boolean);
-    const currentHead = head.stdout.trim();
+      .filter(Boolean),
+    ...lsRemoteResults.flat(),
+  ]).filter((b) => !b.endsWith("/HEAD"));
+  const tagList = tags.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  const currentHead = head.stdout.trim();
+
+  return {
+    enabled: true,
+    rootId: root.id,
+    rootName: root.name,
+    head: currentHead,
+    defaultBranch: chooseDefaultBaseBranch(currentHead, branchList),
+    branches: branchList,
+    tags: tagList,
+  };
+}
+
+app.get("/api/code-context/git/branches", async (req, res) => {
+  const roots = getGitDiffRootSummaries();
+  if (GIT_DIFF_ROOTS.length === 0) {
+    return res.json({ enabled: false, branches: [], roots });
+  }
+  const root = getGitDiffRoot(
+    String(req.query.root || req.query.rootId || "").trim(),
+  );
+  if (!root) {
+    return res.status(404).json({
+      enabled: false,
+      branches: [],
+      roots,
+      error: "Git diff root not found",
+    });
+  }
+  try {
     res.json({
-      enabled: true,
-      head: currentHead,
-      defaultBranch: chooseDefaultBaseBranch(currentHead, branchList),
-      branches: branchList,
-      tags: tagList,
+      ...(await loadGitBranchesForRoot(root)),
+      roots,
     });
   } catch (err: any) {
     res.status(500).json({
       enabled: false,
+      rootId: root.id,
+      rootName: root.name,
       branches: [],
+      roots,
       error: err?.message || "git not available",
     });
   }
 });
 
 app.get("/api/code-context/git/diff-tree", async (req, res) => {
-  if (!GIT_DIFF_DIR) return res.status(400).json({ error: "No git directory" });
+  if (GIT_DIFF_ROOTS.length === 0)
+    return res.status(400).json({ error: "No git diff roots" });
+  const root = getGitDiffRoot(
+    String(req.query.root || req.query.rootId || "").trim(),
+  );
+  if (!root) return res.status(404).json({ error: "Git diff root not found" });
 
   const base = String(req.query.base || "").trim();
   const headRaw = String(req.query.head || "").trim();
@@ -3555,7 +4309,7 @@ app.get("/api/code-context/git/diff-tree", async (req, res) => {
   if (!isValidRef(base))
     return res.status(400).json({ error: "Invalid base ref" });
 
-  const baseSha = await resolveRef(base);
+  const baseSha = await resolveRef(root, base);
   if (!baseSha) return res.status(404).json({ error: "Base ref not found" });
 
   let head = headRaw;
@@ -3565,13 +4319,15 @@ app.get("/api/code-context/git/diff-tree", async (req, res) => {
   } else {
     if (!isValidRef(head))
       return res.status(400).json({ error: "Invalid head ref" });
-    headSha = await resolveRef(head);
+    headSha = await resolveRef(root, head);
     if (!headSha) return res.status(404).json({ error: "Head ref not found" });
   }
 
   try {
-    const files = await getChangedFiles(base, head, mode);
+    const files = await getChangedFiles(root, base, head, mode);
     res.json({
+      rootId: root.id,
+      rootName: root.name,
       base,
       baseSha,
       head: mode === "working-tree" ? WORKING_TREE_SENTINEL : head,
@@ -3586,20 +4342,27 @@ app.get("/api/code-context/git/diff-tree", async (req, res) => {
 });
 
 app.get("/api/code-context/git/diff-file", async (req, res) => {
-  if (!GIT_DIFF_DIR) return res.status(400).json({ error: "No git directory" });
+  if (GIT_DIFF_ROOTS.length === 0)
+    return res.status(400).json({ error: "No git diff roots" });
 
   const base = String(req.query.base || "").trim();
   const headRaw = String(req.query.head || "").trim();
   const mode = parseDiffMode(req.query.mode);
   const filePath = String(req.query.path || "").trim();
   const view = (req.query.view as string) || "patch";
+  const fileRef = getGitDiffFileRef(
+    filePath,
+    String(req.query.root || req.query.rootId || "").trim(),
+  );
 
   if (!isValidRef(base))
     return res.status(400).json({ error: "Invalid base ref" });
-  if (!filePath || filePath.includes("\0"))
-    return res.status(400).json({ error: "Invalid path" });
+  if (!fileRef) return res.status(400).json({ error: "Invalid path" });
 
-  const baseSha = await resolveRef(base);
+  const { root } = fileRef;
+  const relPath = fileRef.relPath;
+
+  const baseSha = await resolveRef(root, base);
   if (!baseSha) return res.status(404).json({ error: "Base ref not found" });
 
   let head = headRaw;
@@ -3608,15 +4371,15 @@ app.get("/api/code-context/git/diff-file", async (req, res) => {
   } else {
     if (!isValidRef(head))
       return res.status(400).json({ error: "Invalid head ref" });
-    const headSha = await resolveRef(head);
+    const headSha = await resolveRef(root, head);
     if (!headSha) return res.status(404).json({ error: "Head ref not found" });
   }
 
   // Verify the path is actually part of the diff so callers cannot read arbitrary repo files.
   let entry: GitDiffFileEntry | undefined;
   try {
-    const files = await getChangedFiles(base, head, mode);
-    entry = files.find((f) => f.path === filePath || f.oldPath === filePath);
+    const files = await getChangedFiles(root, base, head, mode);
+    entry = files.find((f) => f.path === relPath || f.oldPath === relPath);
   } catch (err: any) {
     return res.status(500).json({ error: err?.message || "git diff failed" });
   }
@@ -3625,23 +4388,53 @@ app.get("/api/code-context/git/diff-file", async (req, res) => {
   try {
     if (view === "before") {
       if (entry.status === "A" || entry.status === "?") {
-        return res.json({ path: filePath, view, content: "" });
+        return res.json({
+          path: fileRef.id,
+          rootId: root.id,
+          rootName: root.name,
+          view,
+          content: "",
+        });
       }
-      const refPath = entry.oldPath ?? filePath;
-      const content = await getFileAtRef(base, refPath);
-      return res.json({ path: filePath, view, content });
+      const refPath = entry.oldPath ?? relPath;
+      const content = await getFileAtRef(root, base, refPath);
+      return res.json({
+        path: fileRef.id,
+        rootId: root.id,
+        rootName: root.name,
+        view,
+        content,
+      });
     }
     if (view === "after") {
       if (entry.status === "D") {
-        return res.json({ path: filePath, view, content: "" });
+        return res.json({
+          path: fileRef.id,
+          rootId: root.id,
+          rootName: root.name,
+          view,
+          content: "",
+        });
       }
       const ref = mode === "working-tree" ? WORKING_TREE_SENTINEL : head;
-      const content = await getFileAtRef(ref, filePath);
-      return res.json({ path: filePath, view, content });
+      const content = await getFileAtRef(root, ref, relPath);
+      return res.json({
+        path: fileRef.id,
+        rootId: root.id,
+        rootName: root.name,
+        view,
+        content,
+      });
     }
     // default: patch
-    const patch = await getDiffPatch(base, head, mode, filePath);
-    return res.json({ path: filePath, view: "patch", content: patch });
+    const patch = await getDiffPatch(root, base, head, mode, relPath);
+    return res.json({
+      path: fileRef.id,
+      rootId: root.id,
+      rootName: root.name,
+      view: "patch",
+      content: patch,
+    });
   } catch (err: any) {
     res.status(500).json({ error: err?.message || "git read failed" });
   }
@@ -3728,14 +4521,15 @@ app.post("/api/code-line-ask", async (req, res) => {
     const scopedCodeContextFiles =
       await getScopedCodeContextFiles(codeContextFiles);
 
-    if (scopedCodeContextFiles.length && CODE_CONTEXT_DIR) {
+    if (scopedCodeContextFiles.length && CODE_CONTEXT_ROOTS.length > 0) {
       for (const fp of scopedCodeContextFiles) {
-        const resolved = resolveCodeContextFilePath(fp);
-        if (!resolved) continue;
+        const ref = getCodeContextFileRef(fp);
+        if (!ref) continue;
         fileRegistry.set(
           `code:${fp}`,
-          makeCodeReferenceFileEntry(`[code] ${fp}`, () =>
-            fs.readFile(resolved, "utf-8"),
+          makeCodeReferenceFileEntry(
+            `[code:${ref.root.name}] ${ref.relPath}`,
+            () => fs.readFile(ref.absolutePath, "utf-8"),
           ),
         );
       }
@@ -3776,7 +4570,7 @@ app.post("/api/code-line-ask", async (req, res) => {
       }
 
       if (codeFilePaths.length > 0) {
-        system += `\n--- Code Context Exploration Tools ---\nYou also have read-only tools to list, search, read line ranges, trace textual references, inspect CI/CD config, and run whitelisted read-only inspection commands. These tools are restricted to selected, non-ignored files under CODE_CONTEXT_DIR. If something is missing, ask the user to select more code context or adjust ignore settings.\n\n--- Linking Code Files in Your Response ---\nWhen you mention a [code] file, format it as a clickable link:\n  [DisplayText](coderef://relative/path/to/file)\nOnly use coderef:// for [code] files.`;
+        system += `\n--- Code Context Exploration Tools ---\nYou also have read-only tools to list, search, read line ranges, trace textual references, inspect CI/CD config, and run whitelisted read-only inspection commands. These tools are restricted to selected, non-ignored files under configured code-context roots. File IDs are root-qualified like "root::relative/path". If something is missing, ask the user to select more code context or adjust ignore settings.\n\n--- Linking Code Files in Your Response ---\nWhen you mention a [code] file, format it as a clickable link using the exact code file id without the "code:" prefix:\n  [DisplayText](coderef://root::relative/path/to/file)\nOnly use coderef:// for [code] files.`;
       }
     }
 
@@ -3816,6 +4610,7 @@ app.post("/api/code-line-ask", async (req, res) => {
                 ? { readFile: createReadFileTool(fileRegistry) }
                 : {}),
               ...createCodeContextTools(scopedCodeContextFiles),
+              ...createGitDiffTools(gitDiffContext || {}),
             }
           : undefined,
       stopWhen: stepCountIs(4),