codebase implementation
Implementation boundaries
The plugin entry point in index.mjs registers the three tools and the codebase-index service. It owns the SQLite database, the incremental indexing pass, and the single in-flight claim map shared by manual reindexing, search-triggered refreshes, and scheduled refreshes. The stored schema and repository keys are unchanged.
lib/chunker.mjssplits admitted file text into contiguous line ranges and identifies the enclosing declaration or Markdown heading.lib/config.mjsowns configuration defaults, token-list normalization, numeric bounds, and the glob matchers used by file collection and search. A relevance floor of zero includes zero-score results.lib/sources.mjsowns host file collection, managed guest reads, source selection, and search scope. An explicit host repository is checked throughctx.assertPathAllowed; managed operations carry the selected project and acting account through the Sandbox provider. Without that provider, managed operations fail.lib/scheduledIndexer.mjsimplements the existingctx.registerServicelifecycle as the servicecodebase-index. It receives the entry point's database accessor and guarded pass callback; it never creates a separate indexing path or claim map.
Managed projects are indexed under the key managed:<projectId>, not under a guest path, because every managed project mounts its tree at /workspace. Every guest read re-checks the acting account's access through the Sandbox provider; a managed project's index is searchable only by a session on that project. The scheduled indexer leaves managed projects out, because a timer has no acting account. When a project is removed, its chunks and file rows are deleted from the index.
Host index sources expose key, collect(config, storedFiles) and read(entry) for the indexing pass in index.mjs; they do not expose an authorization callback. Host access is scoped by indexSources and searchScope, with explicit repositories checked through ctx.assertPathAllowed. Managed search scope still calls the managed source's authorize() before reading indexed chunks, and each guest filesystem operation carries the selected project and acting account through Sandbox. Missing Sandbox control or revoked project access fails the managed operation without host fallback. File collection remains bounded to 20,000 files per repository and the configured maximum file size.
Registration reads configuration once. The scheduler checks the embedding configuration live on each tick, stays idle when scheduling or embeddings are disabled, and targets host repositories only. Each pass retains the configured embedding budget; one tick performs at most the configured number of passes per repository. Stopping clears the timer and prevents further repositories or passes after an in-flight embedding request finishes.