Release v1.4.0 — MCP hardening, rerank dampening, config/IaC, benchmarks

.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "codebase-index",
   "displayName": "Codebase Index",
   "description": "Local-first hybrid codebase index. Auto-provisions its Python CLI on first session start; the skill searches the index so Claude reads only the most relevant files.",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "author": {
     "name": "codebase-index contributors"
   },

.claude/skills/codebase-index/.skill_version

@@ -1 +1 @@
-1.3.0
+1.4.0

.codex/skills/codebase-index/.skill_version

@@ -1 +1 @@
-1.3.0
+1.4.0

.opencode/skills/codebase-index/.skill_version

@@ -1 +1 @@
-1.3.0
+1.4.0

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-06-14
+
 ### Added
 - **`clean` is now implemented** (it was a documented-but-stubbed `_todo` since M0).
   `codebase-index clean` resets the index database (`index.sqlite` + WAL/SHM
@@ -37,6 +39,9 @@ All notable changes to this project are documented here. The format is based on
   confidence/provenance model, resolver architecture, and a benchmark gate.
 - **"Trust model in 60 seconds"** callout, identical in `README.md` and
   `docs/SECURITY.md`.
+- **`tests/benchmark_public_RESULTS.md`**: a logged run of the public benchmark
+  suite (Recall@k / MRR / nDCG / token economy / freshness / graph tasks) with the
+  raw JSON and honest scope notes, per the `docs/BENCHMARKS.md` no-overclaim rule.
 
 ### Changed
 - **Reranker: dampened the god-class `in_degree` tiebreak** (`retrieval/rerank.py`).
@@ -270,7 +275,9 @@ All notable changes to this project are documented here. The format is based on
 - Hooks example + `watch` mode for keeping the index fresh without blocking the edit loop (M8).
 - `doctor`, `stats`, `clean` diagnostics/maintenance commands.
 
-[Unreleased]: https://github.com/denfry/codebase-index/compare/v1.2.1...HEAD
+[Unreleased]: https://github.com/denfry/codebase-index/compare/v1.4.0...HEAD
+[1.4.0]: https://github.com/denfry/codebase-index/compare/v1.3.0...v1.4.0
+[1.3.0]: https://github.com/denfry/codebase-index/compare/v1.2.1...v1.3.0
 [1.2.1]: https://github.com/denfry/codebase-index/compare/v1.2.0...v1.2.1
 [1.2.0]: https://github.com/denfry/codebase-index/compare/v1.1.0...v1.2.0
 [1.1.0]: https://github.com/denfry/codebase-index/compare/v1.0.2...v1.1.0

README.md

@@ -64,7 +64,7 @@ If you are opening this repository for the first time, follow this order:
 If you only need the shortest path, run:
 
 ```bash
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 cd your-project
 codebase-index init            # prompts for Claude Code / Codex CLI / OpenCode
 codebase-index index
@@ -73,13 +73,20 @@ codebase-index search "where is authentication implemented?"
 
 ## Project Status
 
-**`1.3.0` is released.** The current release includes repository discovery,
+**`1.4.0` is released.** The current release includes repository discovery,
 SQLite FTS5 storage, Tree-sitter symbols and references, hybrid ranking, graph
 impact analysis, token-budgeted retrieval packets, optional local embeddings,
 hooks/watch support, multi-CLI installation, MCP server support, and a tested
 GitHub-only `pipx` install path.
 
-The `1.3.0` release adds a content-addressed embedding cache (rebuilds reuse
+The `1.4.0` release hardens the MCP contract (a `schema_version` + `tool`
+envelope on every payload, golden-locked per tool, plus a fix so the server
+loads on current `mcp`/`pydantic`), dampens the god-class `in_degree` rerank
+tiebreak (logarithmic, validated no-regression on the public benchmark), and
+labels config/IaC files (Dockerfile, Terraform, HCL, INI, Makefiles) so infra
+surfaces in `stats` and search.
+
+The earlier `1.3.0` release added a content-addressed embedding cache (rebuilds reuse
 vectors for unchanged content), a batched graph build (7–28× faster edge
 resolution plus a new `edges(file_id)` index), a shared CLI/MCP service layer
 (MCP hybrid search now uses the vector channel; `index_stats` reports the
@@ -110,7 +117,7 @@ For most users, install the package from the tagged GitHub release and run
 `init` inside the repository you want to index:
 
 ```bash
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 cd your-project
 codebase-index init            # choose Claude Code, Codex CLI, OpenCode, or all
 codebase-index index
@@ -148,7 +155,7 @@ fetch the package; later sessions are offline. The skill builds its index on
 your first codebase question, so there is no manual `index` step.
 
 **Distribution note:** the plugin bootstrap installs the pinned requirement from
-`requirements.lock`. In `1.3.0`, that lock points at the tagged GitHub release
+`requirements.lock`. In `1.4.0`, that lock points at the tagged GitHub release
 instead of PyPI. You can override it with `CBX_INSTALL_SPEC` when testing a local
 checkout or a different Git ref.
 
@@ -285,7 +292,7 @@ irm https://raw.githubusercontent.com/denfry/codebase-index/main/install.ps1 | i
 
 ```bash
 cd your-project
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 codebase-index init
 codebase-index index
 ```
@@ -305,13 +312,13 @@ the `pipx` environment was likely created with an older Python version. Reinstal
 ```powershell
 pipx uninstall codebase-index
 py -0p
-pipx install --python "<path-to-python-3.11-or-newer>\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pipx install --python "<path-to-python-3.11-or-newer>\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 ```
 
 For example:
 
 ```powershell
-pipx install --python "C:\Users\you\AppData\Local\Programs\Python\Python312\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pipx install --python "C:\Users\you\AppData\Local\Programs\Python\Python312\python.exe" "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 ```
 
 Then run initialization again:
@@ -325,7 +332,7 @@ codebase-index index
 ### Option 2: Install with pipx from GitHub
 
 ```bash
-pipx install "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pipx install "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 cd your-project
 codebase-index init --target auto
 codebase-index index
@@ -343,7 +350,7 @@ pip install -e ".[dev]"
 
 PyPI, `uvx`, Homebrew, signed release checksums, and SBOMs are important for a
 tool that reads entire repositories, but they are not all verified as shipped in
-`1.3.0`. Target install story:
+`1.4.0`. Target install story:
 
 ```bash
 uvx codebase-index init

docs/ARCHITECTURE.md

@@ -2,7 +2,7 @@
 
 ## 1. Overview
 
-`codebase-index` is a **local-first** code intelligence layer for AI coding agents. In `1.3.0`
+`codebase-index` is a **local-first** code intelligence layer for AI coding agents. In `1.4.0`
 it has two shipped faces:
 
 1. **A Claude Code Skill** (`.claude/skills/codebase-index/SKILL.md`) that Claude auto-invokes for

docs/FAQ.md

@@ -10,7 +10,7 @@ This page answers the most common questions about installing, running, and trust
 with `pipx` (isolated) or `pip`, pinned to a release tag for reproducibility:
 
 ```bash
-pipx install "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pipx install "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 ```
 
 Then run `codebase-index init` inside your project and `codebase-index index` to build
@@ -158,8 +158,8 @@ Yes. Use any of these methods:
 
 ## Is it production-ready?
 
-Yes — `codebase-index` is released as **v1.3.0**. The core indexing and search
-functionality is implemented and tested. The current `1.3.0` package includes:
+Yes — `codebase-index` is released as **v1.4.0**. The core indexing and search
+functionality is implemented and tested. The current `1.4.0` package includes:
 
 - Hybrid FTS/path/symbol/vector retrieval
 - Import/call/reference graph expansion and `impact`

docs/INSTALLATION.md

@@ -3,7 +3,7 @@
 This page explains how to install `codebase-index` and make it available in Claude Code, Codex CLI, or OpenCode.
 
 > **Distribution:** `codebase-index` is **not on PyPI**. It is installed directly
-> from GitHub via `git+https://...@<tag>`. Pin to a release tag (e.g. `@v1.3.0`)
+> from GitHub via `git+https://...@<tag>`. Pin to a release tag (e.g. `@v1.4.0`)
 > for reproducible installs; use `@main` to track the latest.
 
 ## Choose Your Path
@@ -28,7 +28,7 @@ Install the tagged GitHub release and scaffold the skill into your project:
 
 ```bash
 cd your-project
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 codebase-index init
 codebase-index index
 ```
@@ -62,13 +62,13 @@ ln -s ~/codebase-index/skill ~/.claude/skills/codebase-index
 
 ```bash
 # Using pip from the tagged GitHub release
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 
 # Using pipx from GitHub (isolated environment)
-pipx install "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pipx install "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 
 # Using uv from GitHub
-uv tool install "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+uv tool install "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 
 # From source (editable mode)
 git clone https://github.com/denfry/codebase-index.git
@@ -91,7 +91,7 @@ pip install -e ".[embeddings-local,watch,dev]"
 
 ### PyPI / uvx / Homebrew status
 
-As of `1.3.0`, this documentation treats GitHub tag installs as the verified
+As of `1.4.0`, this documentation treats GitHub tag installs as the verified
 path. PyPI, `uvx codebase-index init`, Homebrew tap installation, signed
 checksums, and SBOMs are distribution targets for a more complete release story.
 
@@ -108,7 +108,7 @@ brew install denfry/tap/codebase-index
 On a machine with only Python + pipx:
 
 ```bash
-pipx install "git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pipx install "git+https://github.com/denfry/codebase-index.git@v1.4.0"
 cd /path/to/your/repo
 codebase-index init           # writes .claude/skills/codebase-index/ + .gitignore rules
 codebase-index index          # builds .claude/cache/codebase-index/index.sqlite
@@ -131,7 +131,7 @@ Expected output:
 === codebase-index Doctor ===
 
 [OK] Python 3.12 (requires 3.11+)
-[OK] codebase-index package installed (v1.3.0)
+[OK] codebase-index package installed (v1.4.0)
 [OK] tree-sitter is available
 [INFO] Cache directory not yet created: ...
 [INFO] Skill not installed in .claude/skills/
@@ -188,7 +188,7 @@ Use `codebase-index doctor` to verify which hooks are enabled. For heavy editing
 For heavy editing sessions, `watch` mode keeps the index fresh via a debounced filesystem observer. Requires the `[watch]` extra:
 
 ```bash
-pip install "codebase-index[watch] @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index[watch] @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 codebase-index watch --debounce 500
 ```
 
@@ -278,7 +278,7 @@ Set `allow_external` to `false` to disable external API calls.
 ## Recommended Flow for First-Time Users
 
 ```bash
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 cd your-project
 codebase-index init
 codebase-index index

docs/MCP.md

@@ -3,7 +3,7 @@
 `codebase-index` ships a stdio MCP server powered by the optional `mcp` extra:
 
 ```bash
-pip install "codebase-index[mcp] @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index[mcp] @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 codebase-index mcp --root /path/to/repo
 ```
 

docs/QUICKSTART.md

@@ -11,7 +11,7 @@ Use this guide if you are new to `codebase-index` and want the fastest path to y
 ## Step 1: Install
 
 ```bash
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 ```
 
 Or from source:

docs/SEO.md

@@ -177,7 +177,7 @@ Features:
 - Secret redaction
 - Respects .gitignore
 
-Install: pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+Install: pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 GitHub: https://github.com/denfry/codebase-index
 ```
 
@@ -192,5 +192,5 @@ codebase-index builds a local hybrid index so Claude finds the right files witho
 - No network by default
 - Token-efficient output
 
-pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.3.0"
+pip install "codebase-index @ git+https://github.com/denfry/codebase-index.git@v1.4.0"
 ```

docs/installer.md

@@ -108,7 +108,7 @@ pwsh ./install.ps1 -Target claude -InstallDir "D:\skills\codebase-index"
 **Pinning по ветке/тегу** (воспроизводимость и безопасность):
 
 ```sh
-sh install.sh --branch v1.3.0
+sh install.sh --branch v1.4.0
 ```
 
 ---
@@ -151,7 +151,7 @@ sh install.sh --branch v1.3.0
 ```json
 {
   "skill_name": "codebase-index",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "installed_at": "2026-05-29T12:00:00Z",
   "target": "claude",
   "os": "linux",

requirements.lock

@@ -1,3 +1,3 @@
-codebase-index @ https://github.com/denfry/codebase-index/archive/refs/tags/v1.3.0.tar.gz
+codebase-index @ https://github.com/denfry/codebase-index/archive/refs/tags/v1.4.0.tar.gz
 tree-sitter==0.25.2
 tree-sitter-language-pack==1.8.1

scripts/release_smoke.py

@@ -21,7 +21,13 @@
 
 def run(cmd: list[str], cwd: Path | None = None) -> subprocess.CompletedProcess[str]:
     print("+", " ".join(cmd))
-    return subprocess.run(cmd, cwd=cwd, text=True, capture_output=True, check=True)
+    # Decode child output as UTF-8 (the CLI emits UTF-8, e.g. «redacted» / em dashes)
+    # instead of the locale default — on a non-UTF-8 console (e.g. Windows cp1251)
+    # text=True would raise UnicodeDecodeError on the CLI's output.
+    return subprocess.run(
+        cmd, cwd=cwd, capture_output=True, check=True,
+        encoding="utf-8", errors="replace",
+    )
 
 
 def main() -> int:
@@ -50,7 +56,9 @@ def main() -> int:
         )
         run(["git", "init"], cwd=proj)
 
-        run([str(cbx), "--root", str(proj), "init"])
+        # Explicit --target: init's picker is interactive and aborts without a TTY
+        # (e.g. in CI / captured subprocesses), which would fail the smoke spuriously.
+        run([str(cbx), "--root", str(proj), "init", "--target", "claude"])
         assert (proj / ".claude" / "skills" / "codebase-index" / "SKILL.md").is_file()
 
         run([str(cbx), "--root", str(proj), "index"])

src/codebase_index/__init__.py

@@ -4,4 +4,4 @@
 See docs/ARCHITECTURE.md for the module map.
 """
 
-__version__ = "1.3.0"
+__version__ = "1.4.0"