Reported issues for CodeNib
Pod holds 19 of 20 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.
Back to CodeNib.
Most discussed
Proposal: first-class multimodal repository knowledge view
Proposal: first-class multimodal repository knowledge view
Motivation
The first multimodal wiki media PR added source-grounded media slots, local SVG generation, provider-neutral image generation, asset serving, and frontend rendering.
The next step is to make repository-native visual artifacts part of CodeNib's reusable repository context layer. Images and diagrams should not only decorate wiki pages; they should be compiled into persistent, source-grounded repository knowledge that wik
Read the thread · 2026-08-22 · closed · 15 comments
RFC: Expose CodeMiner backbone via MCP server
Summary
Expose CodeMiner's backbone capabilities (semantic indexing, CodeGraph, hybrid retrieval, graph expansion, incremental patching) as MCP (Model Context Protocol) tools over stdio. This lets external agent frameworks (Codex, OpenHands, Claude Code, ADK, Gemini CLI, LangChain) leverage CodeMiner's unique infrastructure without CodeMiner needing to build its own agent orchestration.
Motivation
CodeMiner's core value is its backbone — multi-language semantic indexing (SCIP/LSP/tree-s
Read the thread · 2026-04-07 · closed · 9 comments
ci: restrict persistent runner to trusted full workflow
Problem
wolverine is currently registered as a repository-level self-hosted runner for the public CodeNib repository. A fork pull request can propose a workflow that requests repository runner labels, so hosted-only workflow defaults are not an enforcement boundary. GitHub recommends against exposing reusable self-hosted runners to public repositories.
#461 separates the checked-in PR unit workflow from trusted full CI and moves release/community jobs to GitHub-hosted runners. The remaini
Read the thread · 2026-08-07 · open · 4 comments
RFC: build once, serve everywhere with Pages and artifact-backed MCP
Summary
Make CodeNib a build-once, serve-everywhere repository-context platform. One commit-addressed artifact should support a public static Wiki, local or team MCP clients, and agent integrations without rebuilding the repository or leaking provider credentials.
This RFC extends the completed local Developer Preview in docs/product_roadmap.md. It does not replace the manifest-backed compiler/runtime or introduce a hosted SaaS.
Motivation
CodeNib already provides incremental multi-v
Read the thread · 2026-08-05 · closed · 4 comments
perf(cpp): productionize native clangd query acceleration
Summary
Track the production cutover of CodeNib's capability-scoped native clangd query path for C/C++. A local implementation demonstrates that existing clangd .idx files can feed provider-neutral decoded records and a graph-free FactQueryIndex while retaining lazy CodeGraph materialization.
This tracker does not declare the whole C++ cold-start or storage program complete. It closes the gap between a successful local vertical slice and a production-supported serving path.
Ev
Read the thread · 2026-08-10 · closed · 3 comments
Plan: migrate user-facing product name from CodeMiner to CodeNib
Decision
Rename the paper and user-facing product from CodeMiner to CodeNib without performing a big-bang rename of stable artifact or programmatic identifiers.
The first implementation batch on main should change branding and add compatibility aliases. Destructive identifier changes require a separate explicit decision after the current PR queue is merged.
Naming invariant
| Surface | Decision for the first migration batch |
|---|---|
| Paper title, prose, docs site titl |
Read the thread · 2026-07-24 · closed · 3 comments
perf(scip): gate a lazy FactQueryIndex provider at the MCP boundary
Dependency
Blocked by #597. The consumer-safe receipt/filter proof must land before this provider can be benchmarked.
Goal
Build a lazy SCIP hybrid provider and measure it at the real MCP consumer boundary. The existing Python/Rust +25.3%/+29.2% data compares full decode/build with FactQueryIndex construction; it does not compare the current runtime baseline of loading graph.pkl. This issue decides whether either language is eligible for production routing.
Provider contract
- `d
Read the thread · 2026-08-11 · closed · 2 comments
feat(mcp): route real C++ symbol queries through the hybrid provider
Parent: #545
Problem
The native clangd path is currently reachable through explicit decoder/indexer APIs, but normal graph builds remain unchanged and no production consumer calls LSIndexer.process_query_provider(). MCP LSP tools read ctx.symbol_graph and instantiate StaticLSPProvider(graph) directly, so the measured acceleration is not observed by normal MCP sessions.
Scope
- Add an optional LSP provider to the runtime/server context without making it a serialized mutable artifa
Read the thread · 2026-08-10 · closed · 2 comments
Most recent
perf(scip): bind consumer-safe FactQueryIndex receipts
Problem
Python and Rust FactQueryIndex v1 cleared the raw query-ready gate, but no production consumer calls it. Wiring the current SCIPDecoderCore.decode_query_index() directly into MCP would be incorrect:
- importing
scip_decode_coreimportsCodeGraphand Pythonigraphbefore any query; - compiler
target_dir/exclude_patternsfiltering happens after full graph decode and is not reflected in the native index; - the current snapshot does not bind every source/filter input neede
Read the thread · 2026-08-11 · closed · 0 comments
feat(mcp): add a bounded explore tool surface and session ledger
Problem
The MCP server exposes low-level search and LSP tools but lacks an opt-in exploration surface that can project repeated context into stable references and report bounded session usage.
Scope
- Add an explicit tool-surface selector without changing the default MCP surface.
- Add an explore tool that composes existing retrieval/provider capabilities.
- Track repeated returned ranges in a bounded in-memory session ledger and replace repeats with deterministic pointers.
- Add CLI/se
Read the thread · 2026-08-11 · closed · 0 comments
feat(integrations): add the RepoNavigator jump contract adapter
Problem
RepoNavigator publishes a single jump(file_path, symbol, index?) application contract, but CodeNib has no isolated adapter that can reuse its existing persisted SCIP occurrence or injected LSP definition signals.
Scope
- Add a dependency-light repository provider for the published
jumpinput/output contract. - Prefer persisted semantic occurrences or an injected definition provider and disclose graph-only fallback as degraded.
- Preserve the returned definition path for chai
Read the thread · 2026-08-11 · closed · 0 comments
fix(mcp): enable query-seeded LSP routes
Problem
The shared graph-backed lsp_route implementation and agent skill support query-seeded fallback when no reliable symbol is known: callers pass symbols=[] plus the original request, and the static graph ranks matching endpoint/bridge/provider/type anchors.
The MCP wrapper silently disables that path:
seeds = _coerce_symbols(symbols)
if not seeds:
return []
As a result, an external MCP coding agent must already know an indexed symbol before it can use CodeNib's
Read the thread · 2026-08-07 · closed · 1 comment
fix(regex): bound MCP regex execution time
Problem
RegexNodeIndex executes agent-supplied patterns with Python's backtracking re engine over every indexed node. MCP runs the call in a worker thread, but a pathological match can retain the GIL and cannot be cancelled reliably.
A minimal reproduction with one 20 KB node and (a+)+$ did not complete within a two-second process timeout. This lets one tool request stall the MCP server independently of the result-count bounds.
The base wheel does not currently install a timeout-capa
Read the thread · 2026-08-07 · closed · 1 comment
fix(mcp): enforce LSP navigation request bounds
Problem
The MCP LSP-shaped tools silently rewrote or accepted invalid request budgets:
top_k=0was treated as the provider default because oftop_k or default.- negative values were coerced to one.
- arbitrarily large values were passed through.
- symbol, path, and route query text was unbounded even though unresolved symbols and query fallback can scan the repository-wide graph.
lsp_routeaccepted an unbounded symbols list even though its result budget is finite.
On a real SCIP
Read the thread · 2026-08-07 · closed · 1 comment
fix(mcp): validate direct search budgets and empty queries
Problem
Direct MCP search routes did not share the bounded request contract used by planned search. Blank queries could dump an index, negative top_k values used Python slicing semantics, and arbitrarily large query text could be sent to retrieval or embedding providers.
On current main, top_k=-1 returns all but the final regex result and still returns a BM25 result; blank regex and BM25 queries expose the indexed corpus. Semantic and Zoekt routes accepted the same unbounded inputs.
Read the thread · 2026-08-07 · closed · 1 comment
fix(mcp): bound and deduplicate dependency subgraphs
Problem
A real graph-backed MCP request exposed two contract failures in dependency_subgraph:
- The default
direction=bothroute ignored the publicmax_nodesargument becauseDependencyAnalyzer.subgraph()hard-coded 200 nodes. - Bidirectional BFS emitted the same logical edge again when traversal reached it from the opposite endpoint. A two-hop query over the Python smoke repository returned two identical
referenceedges.
The traversal also appended an edge before deciding whet
Read the thread · 2026-08-07 · closed · 1 comment
fix(logging): honor configured console levels
Problem
Managed CodeNib loggers installed a non-propagating Rich handler at DEBUG, so ordinary CLI commands emitted internal commands and profiler events. codenib mcp --log-level ERROR also still emitted INFO and DEBUG because the entry point later called logging.basicConfig, which could not reconfigure either the existing root handler or the managed Rich handler.
Acceptance criteria
- Normal managed console output defaults to
INFO; explicitDEBUGremains available.
Read the thread · 2026-08-07 · closed · 1 comment
security(rerank): default-deny Hugging Face remote code
Problem
Cross-encoder wrappers override the upstream safe default with trust_remote_code=True. Loading an arbitrary mutable Hugging Face model ID can therefore execute repository-supplied Python code without an explicit caller decision or immutable revision. The eager retrieval pipeline also has no revision/trust controls.
Acceptance criteria
- Default both reranker backends to
trust_remote_code=False. - Require an explicit opt-in plus a full immutable commit SHA for remote
Read the thread · 2026-08-07 · closed · 0 comments
design(mcp): bound evidence responses and add source reads
Summary
Define an explicit MCP evidence-delivery contract that bounds search response content and lets an agent retrieve a precise source window when a ranked hit is truncated.
Implementation: #469, stacked on #450.
Motivation
The request limits in #450 bound result counts, graph depth, and navigation seeds, but repository-node bodies were still unbounded. A one-result BM25 or regex call over a synthetic 1,000,000-character function returned a 1,000,109-byte JSON payload. top_k=100 c
Read the thread · 2026-08-07 · closed · 0 comments
The remaining reports are on the project's issue tracker.