Merge branch 'atam-audit-fixes' — implement all 10 ATAM audit findings

Author: Your Name

crates/ci-cli/src/main.rs

@@ -23,9 +23,9 @@ enum Commands {
         /// Database file path
         #[arg(long)]
         db_path: Option<PathBuf>,
-        /// Tool preset: full (all 16 tools), orient, trace, edit
-        #[arg(long, default_value = "full")]
-        preset: String,
+        /// Tool preset to register. If not provided, uses preset from config.json (default: "full").
+        #[arg(long)]
+        preset: Option<String>,
     },
     /// One-shot index of the project (stub)
     Index {
@@ -79,8 +79,11 @@ async fn main() -> Result<()> {
         } => {
             let root = std::fs::canonicalize(&project_root)?;
             let db = db_path.unwrap_or_else(|| ci_server::default_db_path(&root));
-            tracing::info!("Starting MCP server for {} (preset={})", root.display(), preset);
-            ci_server::serve_stdio_with_preset(root, db, preset).await?;
+            // CLI flag takes precedence; fall back to config.json value (default: "full")
+            let config = ci_core::config::load_config(&root).unwrap_or_default();
+            let effective_preset = preset.unwrap_or_else(|| config.preset.clone());
+            tracing::info!("Starting MCP server for {} (preset={})", root.display(), effective_preset);
+            ci_server::serve_stdio_with_preset(root, db, effective_preset).await?;
         }
         Commands::Index { project_root } => {
             let root = std::fs::canonicalize(&project_root)?;
@@ -94,7 +97,8 @@ async fn main() -> Result<()> {
             }
             let mut conn = rusqlite::Connection::open(&db_path)?;
             ci_core::db::schema::init_db(&conn)?;
-            ci_core::indexer::pipeline::run_indexing_pipeline(&mut conn, &root)?;
+            let phase = std::sync::Arc::new(std::sync::RwLock::new(ci_core::types::IndexingPhase::Scanning));
+            ci_core::indexer::pipeline::run_indexing_pipeline(&mut conn, &root, phase)?;
             let symbol_count: i64 =
                 conn.query_row("SELECT COUNT(*) FROM symbols", [], |r| r.get(0))?;
             let file_count: i64 =

crates/ci-core/src/config.rs

@@ -184,3 +184,26 @@ pub fn load_config(project_root: &Path) -> anyhow::Result<Config> {
 pub fn default_config_json() -> String {
     serde_json::to_string_pretty(&Config::default()).unwrap_or_default()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn config_preset_defaults_to_full() {
+        let config = Config::default();
+        assert_eq!(config.preset, "full");
+    }
+
+    #[test]
+    fn config_preset_from_json() {
+        let tmp = std::env::temp_dir().join(format!("ci_cfg_preset_{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        std::fs::write(tmp.join("config.json"), r#"{"preset": "orient"}"#).unwrap();
+
+        let config = crate::config::load_config(&tmp).unwrap();
+        assert_eq!(config.preset, "orient",
+            "config.json preset must be loaded, got: {}", config.preset);
+    }
+}

crates/ci-core/src/gitignore.rs

@@ -0,0 +1,65 @@
+use std::fs;
+use std::path::Path;
+
+use anyhow::Result;
+
+pub fn ensure_gitignore(project_root: &Path) -> Result<()> {
+    let path = project_root.join(".gitignore");
+    if path.exists() {
+        let content = fs::read_to_string(&path)?;
+        if content.contains(".codeindex") {
+            return Ok(());
+        }
+        // Append with a leading newline if file doesn't already end with one
+        let suffix = if content.ends_with('\n') { ".codeindex/\n" } else { "\n.codeindex/\n" };
+        fs::write(&path, format!("{content}{suffix}"))?;
+    } else {
+        fs::write(&path, ".codeindex/\n")?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::path::PathBuf;
+
+    fn tmp_dir(suffix: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!("ci_gi_{}_{}", suffix, std::process::id()));
+        let _ = fs::remove_dir_all(&dir);
+        fs::create_dir_all(&dir).unwrap();
+        dir
+    }
+
+    #[test]
+    fn creates_gitignore_when_missing() {
+        let dir = tmp_dir("create");
+        ensure_gitignore(&dir).unwrap();
+        let content = fs::read_to_string(dir.join(".gitignore")).unwrap();
+        assert!(content.contains(".codeindex"), "must contain .codeindex, got: {content}");
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn appends_when_gitignore_exists_without_entry() {
+        let dir = tmp_dir("append");
+        fs::write(dir.join(".gitignore"), "target/\n").unwrap();
+        ensure_gitignore(&dir).unwrap();
+        let content = fs::read_to_string(dir.join(".gitignore")).unwrap();
+        assert!(content.contains("target/"), "must preserve existing entries");
+        assert!(content.contains(".codeindex"), "must add .codeindex entry");
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn idempotent_when_entry_already_present() {
+        let dir = tmp_dir("idem");
+        fs::write(dir.join(".gitignore"), "target/\n.codeindex/\n").unwrap();
+        ensure_gitignore(&dir).unwrap();
+        let content = fs::read_to_string(dir.join(".gitignore")).unwrap();
+        // Must NOT have duplicate entries
+        assert_eq!(content.matches(".codeindex").count(), 1, "must not duplicate entry");
+        let _ = fs::remove_dir_all(&dir);
+    }
+}

crates/ci-core/src/indexer/pipeline.rs

@@ -487,14 +487,22 @@ fn normalize_rel(base_dir: &str, rel: &str) -> String {
 /// Scan → extract symbols + call sites (tree-sitter) → rebuild graph
 /// (caller_count, coreness, is_hub). Everything is one transaction so the graph
 /// is never observed half-built.
-pub fn run_indexing_pipeline(conn: &mut Connection, project_root: &Path) -> rusqlite::Result<()> {
+pub fn run_indexing_pipeline(
+    conn: &mut Connection,
+    project_root: &Path,
+    phase: std::sync::Arc<std::sync::RwLock<crate::types::IndexingPhase>>,
+) -> rusqlite::Result<()> {
+    use crate::types::IndexingPhase;
+
     let config = crate::config::load_config(project_root).unwrap_or_default();
     let entry_point_patterns = config.entry_points;
 
     let mut files = Vec::new();
     collect_source_files(project_root, &mut files);
     files.sort();
 
+    *phase.write().unwrap() = IndexingPhase::Parsing;
+
     let now = now_secs();
     let tx = conn.transaction()?;
 
@@ -525,8 +533,13 @@ pub fn run_indexing_pipeline(conn: &mut Connection, project_root: &Path) -> rusq
         )?;
     }
 
+    *phase.write().unwrap() = IndexingPhase::BuildingEdges;
+
     rebuild_graph(&tx, &config.hub_threshold)?;
     tx.commit()?;
+
+    *phase.write().unwrap() = IndexingPhase::Ready;
+
     Ok(())
 }
 
@@ -629,6 +642,34 @@ mod tests {
         conn.query_row(sql, [], |r| r.get(0)).unwrap()
     }
 
+    fn dummy_phase() -> std::sync::Arc<std::sync::RwLock<IndexingPhase>> {
+        std::sync::Arc::new(std::sync::RwLock::new(IndexingPhase::Scanning))
+    }
+
+    #[test]
+    fn test_phase_advances_to_ready_after_pipeline() {
+        use std::sync::{Arc, RwLock};
+        use crate::types::IndexingPhase;
+
+        let dir = std::env::temp_dir().join(format!("ci_idx_phase_{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("a.py"), "def hello():\n    pass\n").unwrap();
+
+        let mut conn = Connection::open_in_memory().unwrap();
+        init_db(&conn).unwrap();
+
+        let phase = Arc::new(RwLock::new(IndexingPhase::Scanning));
+        run_indexing_pipeline(&mut conn, &dir, phase.clone()).unwrap();
+
+        assert_eq!(
+            *phase.read().unwrap(),
+            IndexingPhase::Ready,
+            "Phase must be Ready after pipeline completes"
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn test_phase_transition() {
         let mut sm = IndexStateMachine::new();
@@ -643,7 +684,7 @@ mod tests {
         std::fs::create_dir_all(&dir).unwrap();
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        assert!(run_indexing_pipeline(&mut conn, &dir).is_ok());
+        assert!(run_indexing_pipeline(&mut conn, &dir, dummy_phase()).is_ok());
         let _ = std::fs::remove_dir_all(&dir);
     }
 
@@ -660,7 +701,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         assert_eq!(count(&conn, "SELECT COUNT(*) FROM symbols"), 2);
         assert_eq!(count(&conn, "SELECT COUNT(*) FROM file_index"), 1);
@@ -700,7 +741,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         assert_eq!(
             count(
@@ -739,7 +780,7 @@ mod tests {
 
         let mut conn_default = Connection::open_in_memory().unwrap();
         init_db(&conn_default).unwrap();
-        run_indexing_pipeline(&mut conn_default, &dir).unwrap();
+        run_indexing_pipeline(&mut conn_default, &dir, dummy_phase()).unwrap();
         assert_eq!(
             count(
                 &conn_default,
@@ -756,7 +797,7 @@ mod tests {
         .unwrap();
         let mut conn_custom = Connection::open_in_memory().unwrap();
         init_db(&conn_custom).unwrap();
-        run_indexing_pipeline(&mut conn_custom, &dir).unwrap();
+        run_indexing_pipeline(&mut conn_custom, &dir, dummy_phase()).unwrap();
         assert_eq!(
             count(
                 &conn_custom,
@@ -783,7 +824,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         // The alias is de-referenced, so the edge points at helper.
         assert_eq!(
@@ -811,7 +852,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         // import_edges populated and to_path resolved to the in-project file.
         let (to_path, module): (String, String) = conn
@@ -863,7 +904,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         // Method is class-qualified.
         assert_eq!(
@@ -910,7 +951,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
 
         // Go method is tagged with its receiver type as class_context.
         assert_eq!(
@@ -943,7 +984,7 @@ mod tests {
 
         let mut conn = Connection::open_in_memory().unwrap();
         init_db(&conn).unwrap();
-        run_indexing_pipeline(&mut conn, &dir).unwrap();
+        run_indexing_pipeline(&mut conn, &dir, dummy_phase()).unwrap();
         assert_eq!(count(&conn, "SELECT COUNT(*) FROM symbols"), 1);
 
         // No change → no-op.

crates/ci-core/src/lib.rs

@@ -1,6 +1,7 @@
 pub mod analysis;
 pub mod config;
 pub mod db;
+pub mod gitignore;
 pub mod embedding;
 pub mod fitness;
 pub mod graph;

crates/ci-core/src/search.rs

@@ -150,7 +150,9 @@ fn search_symbol(conn: &Connection, query: &str, limit: usize) -> rusqlite::Resu
 }
 
 fn search_text(conn: &Connection, query: &str, limit: usize) -> rusqlite::Result<SearchOutput> {
-    let fts_query = escape_fts5_query(query);
+    let raw_query = escape_fts5_query(query);
+    // FTS5 global column filter: {docstring} restricts ALL tokens to docstring column only
+    let fts_query = format!("{{docstring}} : {raw_query}");
 
     let mut stmt = conn.prepare(
         "SELECT s.qualified_name, s.name, s.path, s.line_start, s.line_end, s.kind,
@@ -515,6 +517,44 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_search_text_does_not_match_name_only() {
+        let conn = Connection::open_in_memory().unwrap();
+        init_db(&conn).unwrap();
+
+        // Symbol: name contains "authorize", docstring is EMPTY
+        conn.execute(
+            "INSERT INTO symbols (name, qualified_name, kind, path, language, line_start, line_end, docstring, name_tokens)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+            rusqlite::params![
+                "authorize_user", "auth::authorize_user", "function",
+                "auth.py", "python", 1, 10, "", "authorize user"
+            ],
+        ).unwrap();
+
+        // Symbol: name does NOT contain "authorize", docstring DOES
+        conn.execute(
+            "INSERT INTO symbols (name, qualified_name, kind, path, language, line_start, line_end, docstring, name_tokens)
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)",
+            rusqlite::params![
+                "check_perms", "auth::check_perms", "function",
+                "auth.py", "python", 12, 20, "Checks if user can authorize the given action.", "check perms"
+            ],
+        ).unwrap();
+
+        let output = search(&conn, "authorize", SearchKind::Text, 10, None).unwrap();
+        let names: Vec<&str> = output.results.iter().map(|r| r.name.as_str()).collect();
+
+        assert!(
+            names.contains(&"check_perms"),
+            "check_perms (docstring match) must appear, got: {names:?}"
+        );
+        assert!(
+            !names.contains(&"authorize_user"),
+            "authorize_user must NOT appear — its docstring is empty, got: {names:?}"
+        );
+    }
+
     #[test]
     fn test_search_file() {
         let conn = setup_db_with_symbols();

crates/ci-server/src/lib.rs

@@ -26,6 +26,8 @@ pub async fn serve_stdio_with_preset(project_root: PathBuf, db_path: PathBuf, pr
     // unless built with the `embeddings` feature).
     ci_core::embedding::register_extension();
 
+    ci_core::gitignore::ensure_gitignore(&project_root)?;
+
     let server = CodeIntelligenceServer::new_with_preset(project_root.clone(), db_path.clone(), preset)?;
     let ct = CancellationToken::new();
     let ct_clone = ct.clone();
@@ -52,12 +54,13 @@ pub async fn serve_stdio_with_preset(project_root: PathBuf, db_path: PathBuf, pr
         if let Ok(mut conn) = rusqlite::Connection::open(&indexer_db_path) {
             let _ = ci_core::db::schema::init_db(&conn);
             if let Err(e) =
-                ci_core::indexer::pipeline::run_indexing_pipeline(&mut conn, &indexer_root)
+                ci_core::indexer::pipeline::run_indexing_pipeline(&mut conn, &indexer_root, phase.clone())
             {
                 tracing::error!("Background indexer failed: {}", e);
+                // Reset to Scanning so callers don't see BuildingEdges forever on failure.
+                *phase.write().unwrap() = ci_core::types::IndexingPhase::Scanning;
             } else {
-                // Graph is fully built — tools may now report edges_ready.
-                *phase.write().unwrap() = ci_core::types::IndexingPhase::Ready;
+                // Ready is now set inside run_indexing_pipeline (after tx.commit)
                 tracing::info!("Background indexing completed");
             }
             // Opt-in semantic embeddings, after the graph is built.