Skip to content

CodeNib 0.2.0

CodeNib 0.2.0 packages the build-once, serve-everywhere repository-context path. One indexed commit can power a local Wiki, a serverless Pages site, and an MCP server without rebuilding the repository for each surface. Hybrid BM25+dense retrieval is the recommended local and Pages default, while the model-free BM25 path remains available.

The MCP server adds search_context, a capability-aware ranked entry point that reports its BM25, dense, hybrid-RRF, or graph-expanded route with indexed source identity. Verified context artifacts can be rebound to an exact checkout and served through the official ai.codenib/codenib MCP Registry entry. The CLI also detects repository languages and manages pinned package-level SCIP and LSP providers without mutating the target checkout.

Upgrade

python -m pip install --upgrade "codenib[semantic]==0.2.0"
codenib --version
codenib doctor --require core --require wiki

The version command must report codenib 0.2.0. The semantic extra enables the auto preset's BM25+dense route. Install codenib==0.2.0 without extras for the deterministic no-model fallback.

Existing BM25 and vector manifests are checked when opened. CodeNib reuses a compatible view and rebuilds rather than silently substituting an incompatible provider or source identity.

The repository filtering and BM25 builder contracts changed after 0.1.0, so an older BM25 view is rebuilt once and then reused by later 0.2 runs. This upgrade path is exercised by the installed-package release gate.

Graph schema 5 changes definition provenance and TypeScript/TSX import edges. Rebuild graph artifacts created by 0.1.x once:

codenib index /path/to/repository --preset graph --rebuild

GitHub Models is no longer a valid provider because GitHub retired the service. Use the model-free fast route, local Hugging Face embeddings, or an explicit OpenAI-compatible endpoint.

Language-specific graph and live-navigation providers are no longer exposed as a list of shell exports. Install only those needed by one checkout:

python -m pip install "codenib[graph]==0.2.0"
codenib toolchain install /path/to/repository --scope graph
codenib toolchain install /path/to/repository --scope lsp
codenib doctor /path/to/repository --require graph

Publish And Reuse

Call the reusable workflow from a public repository and pin it to the release tag:

permissions:
  contents: read
  pages: write
  id-token: write

jobs:
  publish:
    uses: sysevol-ai/CodeNib/.github/workflows/codenib-pages.yml@v0.2.0

The default workflow publishes precomputed pages, citations, navigation, and available dependency data without a model credential. BM25 and dense queries run from the separately retained context artifact, not inside the static browser application. See GitHub Pages for semantic and BYO endpoint inputs.

After checking out the recorded commit, reuse the artifact without another index build:

python -m pip install --upgrade "codenib[mcp,semantic]==0.2.0"
export GH_TOKEN="$(gh auth token)"
codenib artifact fetch owner/repository --repo /path/to/repository
codenib artifact mcp-config \
  ~/.codenib/artifacts/owner/repository/<full-commit> \
  --repo /path/to/repository \
  --repository owner/repository \
  --host codex

The no-model fast Wiki, export, and MCP paths need no model token. A BYO embedding endpoint receives the environment variable named by --embedding-api-key-env; agent-authored pages receive the provider variable named by --api-key-env. Repository Actions pass embedding credentials through the optional embedding_api_key secret. GH_TOKEN is used only to read the commit-addressed Actions artifact. See the Quickstart for copyable local examples.

Security Boundary

Artifact verification proves byte integrity, repository identity, commit, and source compatibility. It does not make an arbitrary publishing workflow trusted. Consume artifacts only from a workflow and pinned CodeNib revision you trust, and review a semantic artifact's provider and endpoint before exposing model credentials to the MCP process.

Downloaded artifacts cannot contain pickle, symbolic links, special files, or unbounded ZIP expansion. The runtime verifies every inventoried file and binds source locations to an exact local checkout before loading an index. Keep BYO credentials in the Action secret or MCP process environment; they are not part of the Pages site, artifact, manifest, or generated client configuration.