codecortex-context-engine 0.1.0a3__tar.gz → 0.1.0a7__tar.gz

codecortex_context_engine-0.1.0a7/.gitattributes

@@ -0,0 +1,21 @@
+# Conformance fixtures must reach every checkout byte-for-byte.
+#
+# Without this, Git's autocrlf translation rewrites LF to CRLF on a Windows
+# checkout. That silently breaks two guarantees these fixtures exist to make:
+#
+#   * `tests/fixtures/upstream/` is vendored byte-identical to a pinned
+#     upstream revision, and its SHA-256 is recorded in a provenance manifest.
+#     A rewritten line ending makes the committed file no longer the upstream
+#     file, and the digest check that proves it correctly fails.
+#
+#   * `tests/fixtures/real_index/` holds indexes produced by real indexers from
+#     the source files beside them. Those indexes encode byte offsets computed
+#     over LF text, so rewriting the sources would desynchronise the index from
+#     the code it describes.
+#
+# `-text` disables all end-of-line conversion in both directions.
+tests/fixtures/upstream/** -text
+tests/fixtures/real_index/** -text
+
+# A serialized index is protobuf, not text, in any location.
+*.scip binary

{codecortex_context_engine-0.1.0a3 → codecortex_context_engine-0.1.0a7}/.github/workflows/bootstrap-release.yml

@@ -18,19 +18,19 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: true
-      - name: Create v0.1.0a3 release tag from validated main
+      - name: Create v0.1.0a7 release tag from validated main
         shell: bash
         run: |
           set -euo pipefail
           git config user.name "Behnam Jalali"
           git config user.email "behnamjalalico@gmail.com"
-          if git rev-parse -q --verify refs/tags/v0.1.0a3 >/dev/null; then
-            echo "v0.1.0a3 already exists"
+          if git rev-parse -q --verify refs/tags/v0.1.0a7 >/dev/null; then
+            echo "v0.1.0a7 already exists"
           else
-            git tag -a v0.1.0a3 -m "CodeCortex Context Engine v0.1.0a3"
-            git push origin refs/tags/v0.1.0a3
+            git tag -a v0.1.0a7 -m "CodeCortex Context Engine v0.1.0a7"
+            git push origin refs/tags/v0.1.0a7
           fi
       - name: Dispatch release workflow
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh workflow run release.yml --ref main -f tag=v0.1.0a3
+        run: gh workflow run release.yml --ref main -f tag=v0.1.0a7

codecortex_context_engine-0.1.0a7/.github/workflows/ci.yml

@@ -0,0 +1,134 @@
+name: CI
+
+on:
+  push:
+    branches: [main, stabilization-1-10]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,web]"
+      - run: ruff check .
+      - run: mypy
+      - name: Tests
+        run: |
+          if [ "${{ matrix.python-version }}" = "3.13" ]; then
+            pytest -q --cov=codecortex --cov-report=xml --cov-report=term-missing --cov-fail-under=90
+          else
+            pytest -q
+          fi
+      - name: Upload coverage
+        if: matrix.python-version == '3.13' && !cancelled()
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          use_oidc: true
+          files: ./coverage.xml
+          fail_ci_if_error: false
+
+  invariants:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - name: Correctness and fault invariants
+        run: >-
+          pytest -q
+          tests/test_invariant_suite.py
+          tests/test_incremental_graph.py
+          tests/test_state_concurrency.py
+          tests/test_mcp_hardening.py
+          tests/test_distributed_security_regressions.py
+          tests/test_distributed_v2.py
+          tests/test_unified_language_pipeline.py
+          tests/test_retrieval_v2.py
+          tests/test_evidence_fusion.py
+          tests/test_evidence_invariants.py
+          tests/test_evidence_acceptance.py
+          tests/test_evidence_security.py
+          tests/test_evidence_surfaces.py
+          tests/test_precision_intelligence.py
+          tests/test_precision_semantics.py
+          tests/test_precision_conformance.py
+          tests/test_real_index_conformance.py
+          tests/test_precision_generator.py
+          tests/test_dependency_intelligence.py
+          tests/test_dependency_contract.py
+          tests/test_structural_intelligence.py
+
+  platform-contracts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,web]"
+      - run: python scripts/check_platform_architecture.py
+      - run: python scripts/check_platform_priorities.py
+      - run: pytest -q tests/test_platform_acceptance.py tests/test_platform_layout.py tests/test_platform_manifest.py tests/test_platform_milestones.py tests/test_platform_governance.py tests/test_platform_dod.py tests/test_api_versioning.py tests/test_api_security_hardening.py tests/test_sdk_client.py
+
+  windows-compat:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.11"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,web]"
+      - run: ruff check .
+      - run: pytest -q
+      - run: cortex --help
+      - run: cortex version
+
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+      - run: python scripts/check_readme.py
+      - run: python -m pip install --upgrade pip build twine
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - run: pip install dist/*.whl
+      - run: cortex --help
+      - run: cortex version
+      - run: cortex-remote --help

codecortex_context_engine-0.1.0a7/.github/workflows/dependency-docs-live.yml

@@ -0,0 +1,47 @@
+name: Dependency Docs Live Smoke
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/codecortex/dependencies/**"
+      - "tests/test_dependency_live_smoke.py"
+      - ".github/workflows/dependency-docs-live.yml"
+      - "README.md"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  live-documentation:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      CODECORTEX_DEPENDENCY_DOCS_API_KEY: ${{ secrets.CODECORTEX_DEPENDENCY_DOCS_API_KEY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: "3.13"
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev]"
+      - name: Check credential availability
+        id: credential
+        shell: bash
+        run: |
+          if [ -n "${CODECORTEX_DEPENDENCY_DOCS_API_KEY:-}" ]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Run real documentation smoke tests
+        if: steps.credential.outputs.available == 'true'
+        run: pytest -q tests/test_dependency_live_smoke.py -rs
+      - name: Record credential-gated skip
+        if: steps.credential.outputs.available != 'true'
+        run: |
+          echo "SKIPPED — CODECORTEX_DEPENDENCY_DOCS_API_KEY unavailable" | tee -a "$GITHUB_STEP_SUMMARY"

codecortex_context_engine-0.1.0a7/.github/workflows/mcp-registry.yml

@@ -0,0 +1,64 @@
+name: MCP Registry Manifest
+
+on:
+  pull_request:
+    paths:
+      - server.json
+      - pyproject.toml
+      - README.md
+      - scripts/generate_readme.py
+      - .github/workflows/release.yml
+      - .github/workflows/mcp-registry.yml
+  push:
+    branches: [main]
+    paths:
+      - server.json
+      - pyproject.toml
+      - README.md
+      - scripts/generate_readme.py
+      - .github/workflows/release.yml
+      - .github/workflows/mcp-registry.yml
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Verify registry/package identity
+        shell: bash
+        run: |
+          set -euo pipefail
+          python - <<'PY'
+          import json, tomllib
+          from pathlib import Path
+
+          server = json.loads(Path("server.json").read_text(encoding="utf-8"))
+          project = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))["project"]
+          package = server["packages"][0]
+          expected = "io.github.BehnamJalaliCo/codecortex-context-engine"
+          assert server["name"] == expected
+          assert package["registryType"] == "pypi"
+          assert package["identifier"] == project["name"]
+          assert package["version"] == project["version"] == server["version"]
+          assert f"mcp-name: {expected}" in Path("README.md").read_text(encoding="utf-8")
+          assert "codecortex-context-engine" in project["scripts"]
+          print("CodeCortex MCP registry identity is internally consistent")
+          PY
+      - name: Install verified MCP Registry publisher
+        shell: bash
+        env:
+          MCP_PUBLISHER_VERSION: v1.8.1
+          MCP_PUBLISHER_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
+        run: |
+          set -euo pipefail
+          archive="mcp-publisher_linux_amd64.tar.gz"
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/${archive}" -o "${archive}"
+          echo "${MCP_PUBLISHER_SHA256}  ${archive}" | sha256sum -c -
+          tar xzf "${archive}" mcp-publisher
+      - name: Validate server.json against official registry schema
+        run: ./mcp-publisher validate server.json

{codecortex_context_engine-0.1.0a3 → codecortex_context_engine-0.1.0a7}/.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - run: python -m pip install --upgrade pip
-      - run: pip install -e ".[dev]"
+      - run: pip install -e ".[dev,web]"
       - run: python scripts/release_check.py --tag "${{ env.RELEASE_TAG }}"
       - run: ruff check .
       - run: pytest -q
@@ -143,6 +143,45 @@ jobs:
           packages-dir: dist/
           skip-existing: true
 
+
+  publish-mcp-registry:
+    if: vars.PYPI_PUBLISH_ENABLED == 'true'
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ env.RELEASE_TAG }}
+      - name: Set registry version from release tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          VERSION="${RELEASE_TAG#v}"
+          jq --arg v "$VERSION" '.version = $v | .packages |= map(if .registryType == "pypi" then .version = $v else . end)' server.json > server.tmp
+          mv server.tmp server.json
+      - name: Install verified MCP Registry publisher
+        shell: bash
+        env:
+          MCP_PUBLISHER_VERSION: v1.8.1
+          MCP_PUBLISHER_SHA256: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
+        run: |
+          set -euo pipefail
+          archive="mcp-publisher_linux_amd64.tar.gz"
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/${archive}" -o "${archive}"
+          echo "${MCP_PUBLISHER_SHA256}  ${archive}" | sha256sum -c -
+          tar xzf "${archive}" mcp-publisher
+          ./mcp-publisher --help >/dev/null
+      - name: Validate MCP Registry manifest
+        run: ./mcp-publisher validate server.json
+      - name: Authenticate to official MCP Registry
+        run: ./mcp-publisher login github-oidc
+      - name: Publish MCP Registry metadata
+        run: ./mcp-publisher publish server.json
+
   publish-containers:
     needs: quality
     runs-on: ubuntu-latest

codecortex_context_engine-0.1.0a7/.github/workflows/structural-engine.yml

@@ -0,0 +1,61 @@
+name: Structural Engine
+
+# The structural engine is an optional extra. Core CI runs the structural tests
+# against an in-repository stub, so this workflow is the one place the real,
+# version-pinned binary is exercised. No credentials are required.
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - "src/codecortex/structural/**"
+      - "tests/test_structural_intelligence.py"
+      - "tests/fixtures/structural_engine.py"
+      - "pyproject.toml"
+      - ".github/workflows/structural-engine.yml"
+  pull_request:
+    paths:
+      - "src/codecortex/structural/**"
+      - "tests/test_structural_intelligence.py"
+      - "tests/fixtures/structural_engine.py"
+      - "pyproject.toml"
+      - ".github/workflows/structural-engine.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  structural-engine:
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.13"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[dev,structural]"
+      - name: Confirm the pinned engine is installed
+        run: |
+          ast-grep --version
+          ast-grep --version | grep -qF "$(python -c 'from codecortex.structural.engine import TESTED_ENGINE_VERSION as v; print(v)')"
+      - name: Structural search, preview, and guarded apply
+        run: pytest -q tests/test_structural_intelligence.py tests/test_evidence_benchmark.py
+      - name: Real-binary conformance
+        run: pytest -q tests/test_structural_conformance.py
+      - name: Measured evidence benchmark
+        run: |
+          cortex evidence-benchmark --output benchmarks/evidence.json
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: evidence-benchmark-${{ matrix.python-version }}
+          path: benchmarks/evidence.json
+          if-no-files-found: warn

codecortex_context_engine-0.1.0a7/.github/workflows/web-console.yml

@@ -0,0 +1,27 @@
+name: Web Console
+on:
+  push:
+    branches: [main, platform-roadmap-1-47]
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  web:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: web/package.json
+      - run: npm install
+      - run: npm run typecheck
+      - run: npm run build
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:e2e

{codecortex_context_engine-0.1.0a3 → codecortex_context_engine-0.1.0a7}/.gitignore

@@ -1,11 +1,14 @@
 __pycache__/
 *.py[cod]
 .venv/
+.v/
 venv/
 .env
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
+.coverage
+coverage.xml
 dist/
 build/
 *.egg-info/

codecortex_context_engine-0.1.0a7/CHANGELOG.md

@@ -0,0 +1,58 @@
+# Changelog
+
+All notable changes to CodeCortex are documented here. The project follows semantic versioning while in alpha; breaking changes may occur before 1.0 and will be called out explicitly.
+
+## 0.1.0a7
+
+- Fixed a Windows lock-directory race in `FileMutex` discovered by the release matrix.
+- Added bounded retry behavior for transient Windows `PermissionError` lock contention.
+- Added a deterministic regression test for the transient permission-error path.
+- Carries forward the GitHub discovery, onboarding, and official MCP Registry publication work from the unreleased `v0.1.0a6` attempt.
+
+## 0.1.0a6
+
+- Reworked GitHub discovery and first-run onboarding for CodeCortex Context Engine.
+- Added official MCP Registry manifest, PyPI ownership marker, manifest validation, and release publishing.
+- Surfaced Claude Code, Codex, Cursor, Gemini CLI, and OpenCode integration setup.
+- Expanded MkDocs navigation, Getting Started, benchmark evidence, launch materials, and discovery documentation.
+- Added contributor-friendly `good first issue` entry points and product/social discovery assets.
+
+## Unreleased
+
+### Added
+
+- Revision-pinned isolated graph, semantic-symbol/LSP, and context-optimization backends behind stable CodeCortex contracts.
+- Guarded language-server rename, replace-body, insert-before, and insert-after operations in CLI and MCP.
+- Warm backend MCP session pooling, health caching, failure recovery, and concurrent orchestration.
+- Native Tree-sitter parser provider with conservative fallback.
+- Expanded reproducible real-repository benchmark corpus and live coding-agent E2E harness.
+- Docker Core/Full integration CI.
+- CodeQL, dependency review, Bandit, dependency audit, SBOM generation, and security-boundary tests.
+- Production observability dashboard with traces, graph hotspots, architecture drift, benchmark history, latency, token savings, and PR-risk API.
+- Signed release pipeline with checksums, Sigstore bundles, GitHub provenance attestations, PyPI Trusted Publishing, and GHCR publishing.
+- Unified evidence model with categorical trust tiers, provenance, and a central ranking, deduplication, and conflict policy.
+- Precision code intelligence: exact definition, reference, implementation, and occurrence resolution from a compiler/indexer-grade index, with symbol-identity decomposition, staleness detection, incremental caching, and graph fusion.
+- Dependency intelligence: manifest and lockfile discovery across Python, Node, Rust, Go, JVM, and .NET, separating declared constraints from resolved versions, behind an optional documentation-provider contract.
+- Structural search and guarded structural rewrite with typed matches, captures, expiring previews, content-hash transactions, rollback, post-apply reindexing, and validation.
+- New MCP tools: `cortex_precise_definition`, `cortex_precise_references`, `cortex_precise_implementations`, `cortex_symbol_occurrences`, `cortex_precision_status`, `cortex_dependency_info`, `cortex_dependency_docs`, `cortex_dependency_context`, `cortex_structural_search`, `cortex_rewrite_preview`, and `cortex_rewrite_apply` (mutating surface only).
+- New CLI commands: `definition`, `references`, `implementations`, `precision-status`, `dependency`, `dependency-docs`, `structural-search`, `rewrite-preview`, `rewrite-apply`, and `evidence-benchmark`.
+- Measured heuristic-versus-evidence benchmark cases for duplicate symbol names, resolved dependency versions, and mechanical migrations; unmeasurable strategies are reported as skipped.
+- `docs/EVIDENCE_FUSION.md`, plus provenance records for the integrated protocol and optional dependencies under `docs/provenance/`.
+
+### Changed
+
+- Python distribution identity is now `codecortex-context-engine`; the public brand remains CodeCortex Context Engine and the recommended CLI remains `cortex`.
+- Optional backend processes remain isolated from the Core Python dependency environment and are pinned to exact compatible revisions.
+- Documentation now treats benchmark output as evidence only after reproducible execution; missing metrics are never synthesized.
+- Impact analysis weighs exact relationships above inferred ones and reports the evidence mix; `cortex doctor` reports the state of each optional evidence layer.
+- The context pipeline accepts ranked evidence and keeps the stronger record when two providers point at the same location.
+- The package now ships a `py.typed` marker, so `mypy --strict` runs against the distribution and is green across all source files; it is enforced in CI.
+
+### Security
+
+- Semantic edit paths are constrained to the repository root and reject path traversal, absolute escape, and symlink escape.
+- Security reporting now uses GitHub's private vulnerability-reporting flow.
+- Optional external engines run with an explicit argument vector, a resolved absolute executable, bounded runtime, and bounded output; no shell is ever used and nothing is downloaded implicitly.
+- Dependency documentation is disabled by default, transmits only a library name, resolved version, and question, and reads its API key solely from a configured environment variable; credentials are redacted from diagnostics and never persisted.
+- Structural rewrites require an unexpired preview, re-verify every file's content hash before writing, enforce file/match/byte limits, write atomically, and roll back on partial failure.
+- Structural matches and paths are constrained to the repository root, rejecting traversal, absolute escape, and symlink escape.

{codecortex_context_engine-0.1.0a3 → codecortex_context_engine-0.1.0a7}/CONTRIBUTING.md

@@ -2,6 +2,12 @@
 
 Thank you for improving CodeCortex. Focused, tested changes are easier to review and safer to release.
 
+## First contribution
+
+Start with the repository's [good first issues](https://github.com/BehnamJalaliCo/CodeCortex/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22). They are intentionally scoped to be reviewable without requiring knowledge of the entire engine.
+
+If an issue is unclear, ask a question on that issue before building a large change. Do not create speculative rewrites for unassigned work.
+
 ## Development
 
 ```bash

codecortex_context_engine-0.1.0a7/Dockerfile

@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1.7
+FROM python:3.13-slim@sha256:7ce4b6dfe35e55397b7cda544f8a13f191b7ae28dc5aad71fe664dbc9bc2623f AS base
+ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_DISABLE_PIP_VERSION_CHECK=1 CODECORTEX_BACKEND_HOME=/opt/codecortex/backends CODECORTEX_BACKENDS=builtin
+RUN apt-get update && apt-get install -y --no-install-recommends git build-essential ca-certificates && rm -rf /var/lib/apt/lists/* && python -m pip install --no-cache-dir uv
+WORKDIR /app
+COPY pyproject.toml README.md LICENSE NOTICE ./
+COPY src ./src
+RUN python -m pip install --no-cache-dir .
+
+FROM base AS core
+RUN useradd --create-home --uid 10001 cortex && mkdir -p /workspace /opt/codecortex/backends && chown -R cortex:cortex /workspace /opt/codecortex/backends
+USER cortex
+WORKDIR /workspace
+ENTRYPOINT ["cortex"]
+CMD ["--help"]
+
+FROM base AS full
+RUN python -m pip install --no-cache-dir ".[semantic,parsers]" && useradd --create-home --uid 10001 cortex && mkdir -p /workspace /opt/codecortex/backends && chown -R cortex:cortex /workspace /opt/codecortex/backends
+USER cortex
+WORKDIR /workspace
+ENTRYPOINT ["cortex"]
+CMD ["--help"]
+
+FROM base AS api
+RUN python -m pip install --no-cache-dir ".[web,parsers]" && useradd --create-home --uid 10001 cortex && mkdir -p /workspace /var/lib/codecortex /opt/codecortex/backends && chown -R cortex:cortex /workspace /var/lib/codecortex /opt/codecortex/backends
+USER cortex
+WORKDIR /workspace
+EXPOSE 7340
+ENTRYPOINT ["cortex-api"]
+CMD ["--host", "0.0.0.0", "--port", "7340", "--state-dir", "/var/lib/codecortex"]
+
+FROM node:22-alpine AS web-build
+WORKDIR /web
+COPY web/package.json ./
+RUN npm install
+COPY web ./
+RUN npm run build
+
+FROM nginx:1.27-alpine AS console
+COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=web-build /web/dist /usr/share/nginx/html
+EXPOSE 8080
+HEALTHCHECK --interval=15s --timeout=3s --retries=5 CMD wget -q -O /dev/null http://127.0.0.1:8080/ || exit 1