Audit follow-ups and release 1.3.0

.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "codebase-index",
   "displayName": "Codebase Index",
   "description": "Local-first hybrid codebase index. Auto-provisions its Python CLI on first session start; the skill searches the index so Claude reads only the most relevant files.",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "author": {
     "name": "codebase-index contributors"
   },

.claude/skills/codebase-index/.skill_version

@@ -1 +1 @@
-1.2.2
+1.3.0

.codex/skills/codebase-index/.skill_version

@@ -1 +1 @@
-1.2.2
+1.3.0

.gitattributes

@@ -3,3 +3,5 @@
 *.sh    text eol=lf
 *.ps1   text eol=lf
 *.py    text eol=lf
+# cbx — POSIX-скрипт без расширения; CRLF в worktree ломает shebang при копировании
+cbx     text eol=lf

.github/workflows/ci.yml

@@ -19,6 +19,8 @@ jobs:
         run: ruff check src tests
       - name: Mypy
         run: mypy src/codebase_index
+      - name: Skill copies in sync
+        run: python scripts/sync_skill_copies.py --check
 
   test:
     needs: lint

.opencode/skills/codebase-index/.skill_version

@@ -1 +1 @@
-1.2.2
+1.3.0

CHANGELOG.md

@@ -6,13 +6,18 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-06-09
+
 ### Added
 - **Content-addressed embedding cache**: a new `vec_cache` table (keyed by `(model, content_sha)`)
   persists chunk embeddings across rebuilds. Because chunk ids churn on every full rebuild, the
   embedding pass now hashes chunk content and only calls the (potentially slow or paid) backend for
   text never embedded under the active model — unchanged content reuses its cached vector for free.
-
-### Added
+- **Shared CLI/MCP service layer** (`codebase_index/service.py`): both surfaces now resolve the
+  index path, run search sessions, and build stats payloads through the same code, so they cannot
+  drift. Two real drifts were closed: MCP `search_code`/`explain_code` now blend in vector results
+  when embeddings are enabled (previously the vector channel was CLI-only), and MCP `index_stats`
+  now reports the per-language `graph: full|partial` tier the skill keys on.
 - **Repo-wide graph tier in diagnostics**: `stats` now tags each tree-sitter language with
   `graph: full|partial`, and `doctor` adds a `graph_coverage` finding listing Tier-B languages
   present in the index. Surfaces upfront which languages have partial `refs`/`impact` (symbols but
@@ -24,8 +29,24 @@ All notable changes to this project are documented here. The format is based on
   inconclusive rather than authoritative. `coverage.partial` flags this so agents
   fall back to Grep instead of reading "no references" as proof. Markdown output
   prints a matching warning; the skill documents the field.
+- **Skill-copy sync tooling**: `scripts/sync_skill_copies.py` regenerates every committed copy of
+  the skill (`.claude/`, `.codex/`, `.opencode/`, `skills/`, shared `skill/` files) plus all
+  version stamps from the canonical `src/codebase_index/skill_template/`; CI fails when copies
+  drift (`--check`). The package version now lives in one place
+  (`src/codebase_index/__init__.py`) via hatch dynamic versioning.
+- `CBX_NO_SKILL_AUTO_UPDATE=1` disables the silent skill auto-update — used by the test suite,
+  useful for CI and scripted environments.
 
 ### Changed
+- **Graph build is batched**: edge resolution now runs one query for globally-unique symbol names
+  and one pass over file paths (in-memory suffix map) instead of per-edge lookups and up to ~20
+  full-table `LIKE` scans per import edge — 7–28× faster on a small repo with identical results,
+  and the gap grows with repository size. Vector blobs are written with a single batched
+  `executemany`; a new `edges(file_id)` index removes full-table scans from incremental updates
+  and file-deletion cascades.
+- Silent failure paths now report to stderr: the ProcessPool→sequential parsing fallback and skill
+  auto-update failures were previously invisible; vector helpers only swallow
+  `sqlite3.OperationalError` (missing vec tables) instead of every exception.
 - The embedding pass reports cache **misses** (vectors actually computed) as its "embedded" count.
 - `prune_orphan_vectors` now deletes stale `vec_chunks` rows in a single batched `executemany`.
 - **Skill**: documented the `--mode vector` semantic-search path, the `intent`/`mode`/`pagination`
@@ -48,6 +69,10 @@ All notable changes to this project are documented here. The format is based on
   matching `search --mode hybrid`.
 - The `cbx` wrapper whitelist (skill + plugin `bin/`) now includes `doctor`, which the skill's
   fallback diagnostics already invoke; previously `cbx doctor` was refused.
+- The test suite is green on Windows again (`bootstrap` path comparison) and no longer rewrites
+  the committed `.skill_version` stamps as a side effect of running the CLI inside the checkout.
+- `docs/ARCHITECTURE.md` no longer shows two contradictory repository layouts or claims `graph/`
+  is a stub.
 
 ## [1.2.2] - 2026-06-05
 

CONTRIBUTING.md

@@ -105,6 +105,13 @@ the project version unless a maintainer explicitly requests it. Add user-visible
 changes to `CHANGELOG.md` under `[Unreleased]`; maintainers choose the release
 version according to the project's versioning policy.
 
+The version lives in one place: `src/codebase_index/__init__.py` (`__version__`).
+`pyproject.toml` reads it via hatch dynamic versioning. After changing the
+version or anything under `src/codebase_index/skill_template/`, run
+`python scripts/sync_skill_copies.py` to regenerate the committed skill copies
+and version stamps; CI rejects the PR if they drift
+(`python scripts/sync_skill_copies.py --check`).
+
 ## Test Requirements
 
 - All new features must include tests.

README.md

@@ -41,7 +41,7 @@ If you are opening this repository for the first time, follow this order:
 If you only need the shortest path, run:
 
 ```bash
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.2.1"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
 cd your-project
 codebase-index init            # prompts for Claude Code / Codex CLI / OpenCode
 codebase-index index
@@ -50,16 +50,21 @@ codebase-index search "where is authentication implemented?"
 
 ## Project Status
 
-**`1.2.1` is released.** The current release includes repository discovery,
+**`1.3.0` is released.** The current release includes repository discovery,
 SQLite FTS5 storage, Tree-sitter symbols and references, hybrid ranking, graph
 impact analysis, token-budgeted retrieval packets, optional local embeddings,
 hooks/watch support, multi-CLI installation, MCP server support, and a tested
 GitHub-only `pipx` install path.
 
-The `1.2.1` release adds skill auto-update/rollback commands and version stamps
-so installed skills stay in sync with the package automatically.
-The `1.2.0` release added HTML graph export, auto-indexing search commands, and
-updated skill resources.
+The `1.3.0` release adds a content-addressed embedding cache (rebuilds reuse
+vectors for unchanged content), a batched graph build (7–28× faster edge
+resolution plus a new `edges(file_id)` index), a shared CLI/MCP service layer
+(MCP hybrid search now uses the vector channel; `index_stats` reports the
+per-language graph tier), graph-coverage signals in `stats`/`refs`/`impact`,
+CLI pagination via `search --offset`, and single-source versioning with a CI
+gate that keeps every committed skill copy in sync.
+The `1.2.1` release added skill auto-update/rollback commands and version
+stamps so installed skills stay in sync with the package automatically.
 See [CHANGELOG.md](CHANGELOG.md) and
 [docs/ROADMAP.md](docs/ROADMAP.md).
 
@@ -82,7 +87,7 @@ For most users, install the package from the tagged GitHub release and run
 `init` inside the repository you want to index:
 
 ```bash
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.2.1"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
 cd your-project
 codebase-index init            # choose Claude Code, Codex CLI, OpenCode, or all
 codebase-index index
@@ -120,7 +125,7 @@ fetch the package; later sessions are offline. The skill builds its index on
 your first codebase question, so there is no manual `index` step.
 
 **Distribution note:** the plugin bootstrap installs the pinned requirement from
-`requirements.lock`. In `1.2.1`, that lock points at the tagged GitHub release
+`requirements.lock`. In `1.3.0`, that lock points at the tagged GitHub release
 instead of PyPI. You can override it with `CBX_INSTALL_SPEC` when testing a local
 checkout or a different Git ref.
 
@@ -202,7 +207,7 @@ irm https://raw.githubusercontent.com/denfry/codebase-index/main/install.ps1 | i
 
 ```bash
 cd your-project
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.2.1"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
 codebase-index init
 codebase-index index
 ```
@@ -222,13 +227,13 @@ the `pipx` environment was likely created with an older Python version. Reinstal
 ```powershell
 pipx uninstall codebase-index
 py -0p
-pipx install --python "<path-to-python-3.11-or-newer>\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.2.1"
+pipx install --python "<path-to-python-3.11-or-newer>\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.3.0"
 ```
 
 For example:
 
 ```powershell
-pipx install --python "C:\Users\you\AppData\Local\Programs\Python\Python312\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.2.1"
+pipx install --python "C:\Users\you\AppData\Local\Programs\Python\Python312\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.3.0"
 ```
 
 Then run initialization again:
@@ -242,7 +247,7 @@ codebase-index index
 ### Option 2: Install with pipx from GitHub
 
 ```bash
-pipx install "git+https://github.com/denfry/codebase-index.git@v1.2.1"
+pipx install "git+https://github.com/denfry/codebase-index.git@v1.3.0"
 cd your-project
 codebase-index init --target auto
 codebase-index index
@@ -260,7 +265,7 @@ pip install -e ".[dev]"
 
 PyPI, `uvx`, Homebrew, signed release checksums, and SBOMs are important for a
 tool that reads entire repositories, but they are not all verified as shipped in
-`1.2.1`. Target install story:
+`1.3.0`. Target install story:
 
 ```bash
 uvx codebase-index init