code-index v0.41.48

Build: v0.41.48+2534

Installer: install.sh and checksum. Both come from this release commit. To pin the installed binaries too, run it with --tag v0.41.48.

Windows installer: install.ps1 and checksum, from the same release commit. It installs AND updates — the same code does both — verifies the archive against its published .sha256 before unpacking, refuses hostile archive members (absolute paths, .. escapes, symlinks and reparse points, which Expand-Archive does not protect you from), and grants nothing when it installs a package: the bytes go into the machine's store and the approving line is PRINTED for you to run from inside a project. -Help lists the flags; -Tag v0.41.48 pins the binaries.

Four-binary release: code-index-mcp (MCP stdio bridge — the usual entry), code-index-daemon (long-lived watcher + RPC server, auto-spawned), code-index-plugin-host (bounded worker for plugin packages, spawned by the daemon), and code-index (CLI: init, index, watch, doctor, link, plugin).

Fixes

C# resolution (#534, #541): direct bases resolve by type arity and through inherited nested scope; simple type names follow enclosing-namespace precedence with ambiguity handling; an inherited bind is kept when namespace proof is merely incomplete, so missing import facts no longer withdraw correct binds. In the bind-level account for cs-dapper every audited removal was a wrong bind, and the roughly 175 audited additions and all 32 retargets are correct.
Method binds contradicted by evidence are refused (#531): recorded Rust receiver contradictions, undeclared JavaScript/TypeScript runtime globals, and name-only cross-crate decisions. This is a deliberate precision change: py-django (tier 3) resolves 42 fewer references net, where all 56 removals were audited wrong and the 14 additions correct.
Corpus movement of resolved references against the previous baseline: cs-dapper +1,685, rust-ripgrep +52, ts-zod -207, js-express -42. No stage degraded on any pinned repository. The full account is on #534.
Rust macro postfix receivers (index, try, parenthesized) keep their source-backed type again (#540).
XAML lifecycle event handlers are captured and partial event names rejected.
Vue/Svelte single-file components (#546): script languages that are not yet enabled are no longer dropped wholesale. Automatic enablement selects the newest parity-eligible digest per package, defers ambiguous cases, and includes newly shipped package languages. list_files discloses refused files and their reason.

Index state and reads

While the index is reconciling or warming up (#562), read_code serves path and path:start-end targets from live disk bytes and marks them index_pending (no_row_yet or changed_since_indexed). Lookup misses in that state return a retryable index_incomplete with index_state and progress instead of symbol_not_found; once ready, genuine misses keep symbol_not_found. Measured coverage refusals still refuse.
read_code accepts rev for path and range reads at a git revision. Changed symbols carry clipped diff hunks including deleted bodies, and container hunks exclude spans owned by listed children (hunk_in_children) (#558).
When sibling worktrees exist, each provenance entry names its indexed root (#521).
Root detection stops at the nearest Git boundary, so a nested worktree no longer answers from its parent tree (#553).

Replies and daemon

Each MCP session receives disclosure prose once; later replies carry semantics_ref: "code-index://docs/envelope" with all fields kept, and answer_provenance is omitted when unchanged and unremarkable. envelope: "full" per call or CODE_INDEX_ENVELOPE=full restores the full text (#557).
Daemon health stays live when the read pool is saturated, queued requests are cancelled when the peer closes (#512), and a failed SQLite COMMIT no longer leaves an open transaction.
Unix daemons detach from the spawning client's process group (#554).
The activation census is cached per file-set revision, avoiding repeated walks.

Compatibility and package updates

Schema 93 rebuilds existing indexes on first use after the upgrade; it adds indexes that cut cold-index SQLite work.

rmcp is updated to 3.9.0, which clears RUSTSEC-2026-0462. The advisory concerns HTTP client transports this build does not enable. skills/list and skills/get now go through rmcp's typed handlers; their wire bytes are unchanged.

Rust package 0.1.8 carries the #540 fix and is published to the signed channel before this core release. XAML package 0.3.4 was published earlier. No other package changed.

Remaining scope

Under --no-daemon, an incomplete-index refusal still pairs retryable: true with converges_on_retry: false (#562). The evidence-less std-surface refusal stays disabled and the PHP parent:: and leading-backslash items of #531 remain open, as does the third item of #546.

Qualification

Qualified source: b644d7d6b734144cb4dea5c22b9e9aee4b9c324c, merged through PR #564 as 88c51a3aa6083186fe8f03c991357e3ee9f1dfb6 with an identical tree. All four required exact-head workflows passed on the source head, including the native Windows job, both cargo test jobs, the tier-1 corpus, cargo deny, all 11 package suites and corpus lanes, and C#/Timeline compatibility. This tag is on the version-only commit 81ff0158b8be6d982eb362992b546901a81f0aa4, merged through PR #565 as eea2214a21a369840f2b510ac5fb538f8eec8f3e. No check was waived.

Local qualification: one full gate run of 44 legs on the integrated tree before the rmcp update, including the corpus ratchet, the precision gate at 7/7 with zero phantoms, and the nightly-only cost and overhead legs; then deny, fmt, clippy for Linux and windows-gnu, doc, and the MCP, daemon, fallback-rate and core suites on the final source head.

Downloads

Four platforms are built for every release. The table below says which ones THIS release published.

Platform	Archive
Linux x86_64 (glibc)	code-index-v0.41.48-linux-x86_64.tar.gz
Linux x86_64 (static/musl)	code-index-v0.41.48-linux-x86_64-musl.tar.gz
Linux ARM64	code-index-v0.41.48-linux-aarch64.tar.gz
Windows x64	code-index-v0.41.48-windows-x86_64.zip

First-party language packages

Every archive carries code-index-packages/: the first-party language packages at the versions the package channel had published when this release was cut — de.h-dv.csharp-0.1.11 de.h-dv.javascript-0.1.6 de.h-dv.php-0.1.4 de.h-dv.python-0.1.5 de.h-dv.ruby-0.10.2 de.h-dv.rust-0.1.8 de.h-dv.typescript-0.1.7 — each signed by the key below and verified at the install door. code-index languages enable <lang> adopts the bundled package offline. A package is released by its own pkg/<id>/v<version> tag, whose release carries its .cip, .cips and digest, and code-index plugin update <id> reads the package channel, so a package fix reaches you without a new core release.

These release binaries contain no native language parsers. Under auto, enabled languages use their approved packages. First start adopts bundled packages verified against this build's own publisher keys; existing approvals and enablement remain authoritative. If your project explicitly pins a language to builtin, switch it with code-index languages owner <lang> auto; an unavailable builtin is refused rather than silently ignored. To enable languages explicitly:

code-index languages enable csharp
code-index languages enable javascript
code-index languages enable php
code-index languages enable python
code-index languages enable ruby
code-index languages enable rust
code-index languages enable typescript

About that key

sha256:1cb03259a8c870b6db02360abd9351e17e67724d1f8c3509d85c4bf6b06fa72c is a long-lived Ed25519 key held as a secret in this project's CI, used to sign released packages automatically, and it is compiled into the binaries in this release. It signs every first-party package. That trusts this project's release pipeline, not only its maintainers: anyone who can run a release workflow here can produce a package that verifies under it. It adds nothing you had not already granted — the bytes are inside the program you are running, so forging that anchor means forging the binary — but you are entitled to know it is there before a package installs rather than after.

There is no expiry — deliberately, because offline installations must not break on a timer — and withdrawal is on your side and works: code-index plugin trust remove sha256:1cb03259a8c870b6db02360abd9351e17e67724d1f8c3509d85c4bf6b06fa72c. A compiled-in key has no file to delete, so that writes one instead, carrying denied = true; the key stops verifying at the next load, plugin trust list shows it marked [DENIED], and deleting that file (the command prints its path) is the only undo. If the key is ever rotated, the new fingerprint is published here and in tests/packages/first-party.fingerprint, and a build that predates the rotation will not trust it.

macOS is not currently built. No x86_64-apple-darwin or aarch64-apple-darwin archive is published — macOS users should build from source (cargo build --release). This is a deliberate deferral, tracked in #59; no date is promised.

Wire into Claude Code

{ "mcpServers": { "code-index": { "command": "/usr/local/bin/code-index-mcp", "args": ["--root", "/path/to/your/project"] } } }

SHA256 checksums (.sha256 files) available for every archive.

Downloads

Source code (ZIP)
0 downloads
Source code (TAR.GZ)
0 downloads

code-index-v0.41.48-linux-aarch64.tar.gz
0 downloads · 2026-11-10 12:14:50 +01:00 · 27 MiB
code-index-v0.41.48-linux-aarch64.tar.gz.sha256
0 downloads · 2026-11-10 12:14:50 +01:00 · 107 B
code-index-v0.41.48-linux-x86_64-musl.tar.gz
0 downloads · 2026-11-10 12:14:51 +01:00 · 30 MiB
code-index-v0.41.48-linux-x86_64-musl.tar.gz.sha256
0 downloads · 2026-11-10 12:14:51 +01:00 · 111 B
code-index-v0.41.48-linux-x86_64.tar.gz
4 downloads · 2026-11-10 12:14:51 +01:00 · 29 MiB
code-index-v0.41.48-linux-x86_64.tar.gz.sha256
2 downloads · 2026-11-10 12:14:51 +01:00 · 106 B
code-index-v0.41.48-windows-x86_64.zip
0 downloads · 2026-11-10 12:14:52 +01:00 · 30 MiB
code-index-v0.41.48-windows-x86_64.zip.sha256
0 downloads · 2026-11-10 12:14:52 +01:00 · 105 B
install.ps1
0 downloads · 2026-11-10 12:14:49 +01:00 · 53 KiB
install.ps1.sha256
0 downloads · 2026-11-10 12:14:50 +01:00 · 78 B
install.sh
0 downloads · 2026-11-10 12:14:50 +01:00 · 36 KiB
install.sh.sha256
0 downloads · 2026-11-10 12:14:50 +01:00 · 77 B
registry.v1.json
1 download · 2026-11-10 12:14:50 +01:00 · 16 KiB
registry.v1.json.sha256
0 downloads · 2026-11-10 12:14:50 +01:00 · 83 B
registry.v1.json.sig
1 download · 2026-11-10 12:14:50 +01:00 · 112 B