-
code-index v0.31.1
StableAll checks were successfulCI / cargo fmt (push) Successful in 51sCI / OSS corpus tier-3 scale (nightly) (push) Has been skippedCI / Grammar rebuild from source (nightly) (push) Has been skippedCI / CI lane wall-clock headroom (push) Successful in 50sCI / guest crates (fmt, clippy, doc) (push) Successful in 1m25sCI / cargo doc (intra-doc links) (push) Successful in 5m25sCI / cargo deny (push) Successful in 5m37sCI / cargo clippy (push) Successful in 6m35sCI / cargo test (abi, 32-bit + wasm32) (push) Successful in 6m47sCI / cargo check (MSRV 1.98) (push) Successful in 6m49sCI / cargo check (windows-gnu) (push) Successful in 6m58sCI / OSS corpus (tier 1) (push) Successful in 30m27sCI / cargo test (push) Successful in 40m59sCI / cargo test (daemon transport) (push) Successful in 20m25sCI / Plugin path cost + pool throughput (nightly) (push) Has been skippedCI (Windows) / fmt + clippy + build + test (windows) (push) Successful in 1h32m32sRelease Build / Generate Version (push) Successful in 28sRelease Build / Required CI green (push) Successful in 1m4sRelease Build / Build linux-aarch64 (push) Successful in 12m48sRelease Build / Build linux-x86_64 (push) Successful in 15m50sRelease Build / Build linux-x86_64-musl (push) Successful in 16m5sRelease Build / Pack the Svelte language package (push) Successful in 51sRelease Build / Pack the Ruby language package (push) Successful in 57sRelease Build / Pack the XAML reference package (push) Successful in 1m8sRelease Build / Pack the TimeLine package (push) Successful in 1m18sRelease Build / Build windows-x86_64 (push) Successful in 21m56sRelease Build / Windows archive smoke (msvc) (push) Successful in 23sRelease Build / Create Forgejo Release (push) Successful in 5m47sbuildagent released this
2026-09-22 20:55:32 +02:00 | 188 commits to master since this releasecode-index v0.31.1
Build: v0.31.1+884
Installer: install.sh and checksum. Both come from this release commit. To pin the installed binaries too, run it with
--tag v0.31.1.Windows installer: install.ps1 and checksum, from the same release commit. It installs AND updates — the same code does both — verifies the archive against its published
.sha256before unpacking, refuses hostile archive members (absolute paths,..escapes, symlinks and reparse points, whichExpand-Archivedoes not protect you from), and grants nothing when it installs a package: the bytes go into the machine's store and the approving line is PRINTED for you to run from inside a project.-Helplists the flags;-Tag v0.31.1pins the binaries.Four-binary release:
code-index-mcp(MCP stdio bridge — the usual entry),code-index-daemon(long-lived watcher + RPC server, auto-spawned),code-index-plugin-host(bounded worker for plugin packages, spawned by the daemon), andcode-index(CLI: init, index, watch, doctor, link, plugin).The defect
Every member of the windows-x86_64 archive used a backslash path
separator, in this release's three predecessors as well as v0.31.0.
APPNOTE 4.4.17.1 says the separator is/, andinstall.ps1refuses a
non-conforming archive — so the supported Windows install path had been
broken since v0.30.0, the release that added that refusal, and three
releases went out over it with every gate green.A user hit it on a clean Windows machine within hours of v0.31.0.
Why the writer produced them
The archive was packed with
ZipFile::CreateFromDirectory, adopted in
#231 specifically to avoid backslashes, on the recorded basis that it
"writes '/' unconditionally". That holds on .NET Core and .NET 5+. Every
PowerShell step in the release workflow declaresshell: powershell—
Windows PowerShell 5.1, on .NET Framework — where the same call
emitsPath.DirectorySeparatorChar. The fix was real and the hazard was
named correctly; the premise was wrong about the runtime it ran on.Why nothing caught it
Three instruments, each reasonable, all blind in the same direction:
windows-archive-smokeunpacked withExpand-Archive, the one
unpacker that tolerates a backslash — named as such in the
workflow's own comment, one screen earlier. Every path assertion after
the unpack then passed.installer_ps1_e2e.rsgrades the installer's refusals against
fixture archives it builds itself, so the check and the malformed
artefact were never in the same room.- The writer asserted nothing about what it had written.
No gate was missing an assertion. They were pointed at synthetic inputs,
or made after a normalising step had destroyed the evidence.The repairs
- Entry names are built by hand as
<name>/<file>— a literal/— and
the step then reopens the finished zip and refuses a backslash or
an unexpected root. - The smoke job reads the shipped entry names before it unpacks.
windows-archive-smokenow runs the repository's owninstall.ps1
against the archive the run just built, then executes each installed
binary and matches--versionagainst the tag. This is the step whose
absence let the defect ship three times.windows_archive_shape.rsmoves all of it tocargo test.
For users on v0.31.0 or earlier
Expand-Archivetolerates the malformed archive, so a manual unpack
works and the published.sha256still verifies the bytes. v0.31.1
installs normally.No schema migration, no plugin activation change, and no change to any
published catalog field. All four language packages are republished
under this tag.Downloads
Four platforms are built for every release. The table below says which ones THIS release published.
Platform Archive Linux x86_64 (glibc) code-index-v0.31.1-linux-x86_64.tar.gz Linux x86_64 (static/musl) code-index-v0.31.1-linux-x86_64-musl.tar.gz Linux ARM64 code-index-v0.31.1-linux-aarch64.tar.gz Windows x64 code-index-v0.31.1-windows-x86_64.zip XAML plugin package
de.h-dv.xaml-0.2.0.cipmakes.xamlfiles carry symbols and references instead of being text-only:x:ClassandClick=handlers bind into the paired C# code-behind,x:Namebecomes a searchable declaration, and{Binding …}stays unresolved because no bridge can reach it.It is NOT installed by installing code-index. Packages are installed into a user-controlled store and approved per project, and installing grants nothing —
enableis the grant.Download
de.h-dv.xaml-0.2.0.cipstoo and keep the.cipsbeside the.cip. Packages are signed and an unsigned one is refused (signature_missing) with no flag that accepts it. You do NOT need to anchor us first: this release's publisher key is compiled into the binary, so the install below works on a machine that has anchored nobody.code-index plugin trust listshows it, marked[BUILTIN], andcode-index plugin trust remove sha256:1cb03259a8c870b6db02360abd9351e17e67724d1f8c3509d85c4bf6b06fa72cwithdraws it — see About that key.code-index plugin install de.h-dv.xaml-0.2.0.cip --sha256 sha256:7b572f5cc32ffcd5af550900a451bbef37e255804776d7e3e3e71d2dd7d0aa79 code-index plugin check sha256:7b572f5cc32ffcd5af550900a451bbef37e255804776d7e3e3e71d2dd7d0aa79 code-index plugin enable sha256:7b572f5cc32ffcd5af550900a451bbef37e255804776d7e3e3e71d2dd7d0aa79 \ --capabilities bridge_source \ --bridges 'de.h-dv.xaml/xaml:type->csharp:class,de.h-dv.xaml/xaml:call->csharp:method'The digest above is the one this release packed and it is what
--sha256pins;de.h-dv.xaml-0.2.0.cip.digest.txtcarries it and the extraction identity. A digest that changes between releases means the package changed — re-pin, and read the notes.Only
.xamlis claimed by this package. The TimeLine package below claims.dataset,.xsql,.shdand.lgd, and the Svelte package below claims.svelte; all other markup remains text-only (searchable, no symbols).TimeLine plugin package
de.h-dv.timeline-0.1.0.cipmakes the four TimeLine definition formats carry symbols and references instead of being text-only:.datasetand.xsqlthrough one language,.shdand.lgdthrough another, both out of a single sandboxed extractor. References resolve INSIDE a definition file; nothing in v1 crosses into the C# that loads it.It is NOT installed by installing code-index. Packages are installed into a user-controlled store and approved per project, and installing grants nothing —
enableis the grant.Download
de.h-dv.timeline-0.1.0.cipstoo and keep the.cipsbeside the.cip. The same signature rules apply as for the XAML package above, and the same key signs both.code-index plugin install de.h-dv.timeline-0.1.0.cip --sha256 sha256:150ceb22ed9757a660d5a2bf58b80c81b60043cc419e5da5dde559d5d6fc9c9f code-index plugin check sha256:150ceb22ed9757a660d5a2bf58b80c81b60043cc419e5da5dde559d5d6fc9c9f code-index plugin enable sha256:150ceb22ed9757a660d5a2bf58b80c81b60043cc419e5da5dde559d5d6fc9c9f \ --capabilities same_file_candidate,exported_candidateNo
--bridges, and that is the package saying so: it declares none, so there is nothing to grant. The digest above is the one this release packed and it is what--sha256pins;de.h-dv.timeline-0.1.0.cip.digest.txtcarries it and the extraction identity.The 5 fixtures shipped inside it are synthetic and modelled on the worked examples in the two format specifications. They carry no customer definition.
Ruby plugin package
de.h-dv.ruby-0.6.0.cipis the compiled-in Ruby extractor as an EXTERNAL, sandboxed package:tree-sitter-rubyloaded at runtime, the extractor compiled towasm32-unknown-unknownand byte-reproducible fromcrates/guest/ruby/, and the same symbols, references, visibility and Rails association names the built-in produces.It claims
.rbx, not.rb. The compiled-in Ruby plugin owns.rb,.rake,.gemspec,RakefileandGemfile, and a package may not claim a file a built-in claims. So installing this changes NOTHING about how your.rbfiles are indexed — it is the migration proof for running a full language out of a package, published so it can be read and run rather than described. Do not install it expecting to replace built-in Ruby support.It is NOT installed by installing code-index. Packages are installed into a user-controlled store and approved per project, and installing grants nothing —
enableis the grant.Download
de.h-dv.ruby-0.6.0.cipstoo and keep the.cipsbeside the.cip. The same signature rules apply as for the packages above, and one key signs every package in this release.code-index plugin install de.h-dv.ruby-0.6.0.cip --sha256 sha256:a6b8d7787cecb49c225ff3dda9016c96babc00c4cf59242a2d774c8b06672048 code-index plugin check sha256:a6b8d7787cecb49c225ff3dda9016c96babc00c4cf59242a2d774c8b06672048 --derived-names code-index plugin enable sha256:a6b8d7787cecb49c225ff3dda9016c96babc00c4cf59242a2d774c8b06672048 --derived-names \ --capabilities same_file_candidate,exported_candidate,reachability_anchor,qualified_candidate,type_position_candidate,member_candidate--derived-namesis required oncheckas well as onenable, and without itcheckREPORTS FAILED. Rails'has_many :postsemits a type reference namedPostat the span of the literal:posts, so the name was not copied out of the source it points at; validation is all-or-nothing per file, so the authority is what admits the whole file rather than the one row. Withhold it and you keep the package with every Rails file refused — that is a supported answer, not a broken install.No
--bridges: Ruby resolves inside its own language, so the package declares none. The six capabilities above are exactly what its manifest requests andenablerefuses a grant wider than the request; grant fewer and the index stays searchable but resolves less, because every candidate pool a reference could be admitted to is one of them.The digest above is the one this release packed and it is what
--sha256pins;de.h-dv.ruby-0.6.0.cip.digest.txtcarries it and the extraction identity.The 5 fixtures shipped inside it were generated from the COMPILED-IN Ruby extractor, by a different author from the port they grade, and
plugin checkcompares the package's facts against them exhaustively.Svelte plugin package
de.h-dv.svelte-0.1.0.cipmakes.sveltefiles carry symbols and references instead of being text-only: the TEMPLATE half of a single-file component — markup, mustaches,{#snippet}declarations and{@render}uses — out of one sandboxed extractor over thetree-sitter-svelte-nggrammar.It claims
.svelteand NOTHING ELSE..svelte.tsand.svelte.jsare deliberately not claimed and this package declares no[[displaces]]: those files are Svelte 5 runes modules, valid TypeScript and valid JavaScript, which the built-in plugins already index correctly. Claiming them would take files away from a producer that reads them in order to read them worse.It is NOT installed by installing code-index. Packages are installed into a user-controlled store and approved per project, and installing grants nothing —
enableis the grant.Download
de.h-dv.svelte-0.1.0.cipstoo and keep the.cipsbeside the.cip. The same signature rules apply as for the packages above, and one key signs every package in this release.code-index plugin install de.h-dv.svelte-0.1.0.cip --sha256 sha256:4b10a478532d67f3694995373e1a64d397611af5c4f2615c085b006628b3322f code-index plugin check sha256:4b10a478532d67f3694995373e1a64d397611af5c4f2615c085b006628b3322f code-index plugin enable sha256:4b10a478532d67f3694995373e1a64d397611af5c4f2615c085b006628b3322f \ --capabilities same_file_candidateOne capability, and that is the package asking for exactly what it can use. Every symbol this version emits is a
{#snippet}, whose visibility isfile: reachable by name anywhere in its own component and nowhere else.exported_candidatewould admit an empty set, so it is not requested — andenablerefuses a grant wider than the manifest asks for, so the line above cannot be padded. No--bridges: this package declares none.The digest above is the one this release packed and it is what
--sha256pins;de.h-dv.svelte-0.1.0.cip.digest.txtcarries it and the extraction identity.The 4 fixtures shipped inside it are synthetic: one positive control in which every rule fires, two that are bait for all of them with an empty expectation, and one malformed source. None carries anybody's component.
About that key
sha256:1cb03259a8c870b6db02360abd9351e17e67724d1f8c3509d85c4bf6b06fa72cis a long-lived Ed25519 key held as a secret in this project's CI, used to sign released packages automatically, and it is compiled into the binaries in this release. It signs every package above. That trusts this project's release pipeline, not only its maintainers: anyone who can run a release workflow here can produce a package that verifies under it. It adds nothing you had not already granted — the bytes are inside the program you are running, so forging that anchor means forging the binary — but you are entitled to know it is there before a package installs rather than after.There is no expiry — deliberately, because offline installations must not break on a timer — and withdrawal is on your side and works:
code-index plugin trust remove sha256:1cb03259a8c870b6db02360abd9351e17e67724d1f8c3509d85c4bf6b06fa72c. A compiled-in key has no file to delete, so that writes one instead, carryingdenied = true; the key stops verifying at the next load,plugin trust listshows it marked[DENIED], and deleting that file (the command prints its path) is the only undo. If the key is ever rotated, the new fingerprint is published here and intests/packages/first-party.fingerprint, and a build that predates the rotation will not trust it.You may anchor it yourself instead —
code-index plugin trust add code-index-publisher.pub --fingerprint sha256:1cb03259a8c870b6db02360abd9351e17e67724d1f8c3509d85c4bf6b06fa72c --name 'a label you choose', withcode-index-publisher.pubfrom this release's assets. Your file replaces the compiled-in entry, and the--nameis a label YOU choose: nothing in the package, the key file or the signature can name its own publisher.macOS is not currently built. No
x86_64-apple-darwinoraarch64-apple-darwinarchive is published — macOS users should build from source (cargo build --release). This is a deliberate deferral, tracked in #59; no date is promised.Wire into Claude Code
{ "mcpServers": { "code-index": { "command": "/usr/local/bin/code-index-mcp", "args": ["--root", "/path/to/your/project"] } } }SHA256 checksums (.sha256 files) available for every archive.
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads