From 45ca1888fee9af65b3670a7e814e718e67c0ad19 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 6 Oct 2026 09:08:02 +0000
Subject: [PATCH 1/3] chore(master): release 2.4.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 35 +++++++++++++++++++++++++++++++++++
 package.json                  |  2 +-
 3 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 9965a34..a549f59 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "2.3.0"
+  ".": "2.4.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c7647d..4664521 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,40 @@
 # Changelog
 
+## [2.4.0](https://github.com/PatrickSys/codebase-context/compare/v2.3.0...v2.4.0) (2026-10-06)
+
+
+### Features
+
+* **analyzers:** recognize NestJS projects ([a8e354e](https://github.com/PatrickSys/codebase-context/commit/a8e354e23826df3edbf4ae4dd50d6c494559d7f9))
+* **analyzers:** Recognize NestJS projects ([754130d](https://github.com/PatrickSys/codebase-context/commit/754130dda398b463024de7ea6668c4c849e40d2e))
+* **indexing:** Make chunk limits configurable per project ([1612414](https://github.com/PatrickSys/codebase-context/commit/161241480e08ff6e9794f91da1cff28a541edd3b))
+* **review:** add bounded review-context packets ([2c56b10](https://github.com/PatrickSys/codebase-context/commit/2c56b10ff32d588d9d660a586c0defee5a3d76d1))
+
+
+### Bug Fixes
+
+* **analyzers:** Prefer NestJS provider analysis ([6093099](https://github.com/PatrickSys/codebase-context/commit/6093099e02e39d2babff58d26a4f0fff634e0ce5))
+* **analyzers:** Recognize current React and Next patterns ([9ed8577](https://github.com/PatrickSys/codebase-context/commit/9ed8577cc930255debaba335b989295c38138b87))
+* **analyzers:** Tie React use metadata to imports ([0154f45](https://github.com/PatrickSys/codebase-context/commit/0154f45d0fd5053c6215f6d540b557bc7f2ccefd))
+* **eval:** align ContextBench harness evidence contracts ([4513979](https://github.com/PatrickSys/codebase-context/commit/45139796f4e0cc51854de906b0b40b66beb8b4e3))
+* **eval:** deduplicate blocked ContextBench rows ([99c9753](https://github.com/PatrickSys/codebase-context/commit/99c975359ef1af300ae4dbe4f430b734802bcdb9))
+* **eval:** deduplicate blocked ContextBench rows ([c41e844](https://github.com/PatrickSys/codebase-context/commit/c41e844b6d85318ff9b30b966a84147430e6c7ad))
+* **eval:** harden ContextBench fixture verification ([bed5064](https://github.com/PatrickSys/codebase-context/commit/bed5064c6177f202b24f9564b083bf68068641ba))
+* **eval:** harden ContextBench manifest checks ([04a6cfb](https://github.com/PatrickSys/codebase-context/commit/04a6cfbc2a66953420645173df3e6e5d19cd50bf))
+* **eval:** preserve ContextBench executor model provenance ([867ac70](https://github.com/PatrickSys/codebase-context/commit/867ac700d98ad141ee180f6353784f9dab1f26fc))
+* **format:** format ContextBench harness sources ([b2fa208](https://github.com/PatrickSys/codebase-context/commit/b2fa208a4df0579bfdc41d8ffe2a74b2fae6e93e))
+* **git:** scope local artifact ignores ([ef42e53](https://github.com/PatrickSys/codebase-context/commit/ef42e53b99f1deed3a7e2107d8124b554b890860))
+* **reranker:** Score passages with the supported tokenizer pair API ([55b97b9](https://github.com/PatrickSys/codebase-context/commit/55b97b9c2261278d3c92ee1f3000d0a80920432d))
+* **test:** harden ContextBench schema cleanup ([c5a74af](https://github.com/PatrickSys/codebase-context/commit/c5a74afb64c65b255a363e31974fa7be6d58242d))
+* **test:** isolate ContextBench baseline Git env ([6aed9d1](https://github.com/PatrickSys/codebase-context/commit/6aed9d1a93f540f0d4a17142ab4527769b97cecb))
+* **test:** isolate ContextBench git fixtures ([62d3110](https://github.com/PatrickSys/codebase-context/commit/62d3110503b4eca3e4ff65a8403bd0644861d61f))
+* **test:** relax slow Windows integration timeouts ([5675ebd](https://github.com/PatrickSys/codebase-context/commit/5675ebdd41f2af784d86c1ec3e25c9e756f80d6b))
+* **test:** relax slow Windows search timeouts ([cad646d](https://github.com/PatrickSys/codebase-context/commit/cad646d9d940c00ab96baa0ca806070722cced32))
+* **test:** relax zombie guard timeout jitter ([5a5bf68](https://github.com/PatrickSys/codebase-context/commit/5a5bf68302745f90b1dbdfba3ab06cfff961d4d5))
+* **test:** tolerate ContextBench runner cleanup races ([c027703](https://github.com/PatrickSys/codebase-context/commit/c027703092a81c90b5c19371873858e5a87ec00c))
+* **test:** tolerate ContextBench schema cleanup races ([a155d56](https://github.com/PatrickSys/codebase-context/commit/a155d5646dbb283ffac1e71eef7fb26b8a59fa40))
+* **test:** tolerate ContextBench temp cleanup races ([0360cb9](https://github.com/PatrickSys/codebase-context/commit/0360cb97d99337438e1922bf52a76833b9d20fd6))
+
 ## [2.3.0](https://github.com/PatrickSys/codebase-context/compare/v2.2.0...v2.3.0) (2026-04-30)
 
 
diff --git a/package.json b/package.json
index 2b75047..bace91c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "codebase-context",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Bounded conventions map and local-pattern discovery for AI coding agents. Local-first MCP server with AST-backed hybrid search.",
   "type": "module",
   "main": "./dist/lib.js",

From 1ba53f6164ec85b73da5564dfb73c13f0d94c9c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Rossell=C3=B3=20Colom?=
 <74001504+PatrickSys@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:04:54 +0200
Subject: [PATCH 2/3] docs: align 2.4.0 release guidance

---
 README.md              | 36 ++++++++++++++-----------
 docs/capabilities.md   | 21 ++++++++-------
 docs/cli.md            | 50 +++++++++++++++++------------------
 docs/client-setup.md   | 60 +++++++++++++++++++++---------------------
 docs/demo.md           | 12 ++++-----
 docs/review-context.md |  4 +--
 6 files changed, 94 insertions(+), 89 deletions(-)

diff --git a/README.md b/README.md
index 6249c02..2e86d5d 100644
--- a/README.md
+++ b/README.md
@@ -10,31 +10,31 @@ Codebase Context gives an agent a local view of that information through code se
 
 ## Set up your AI client
 
-Choose your coding tool and run its command once. Use Node.js 22 or newer. These commands use published npm `2.2.0` and do not require a project folder in your configuration:
+Choose your coding tool and run its command once. Use Node.js 22 or newer. These commands use published npm `2.4.0` and do not require a project folder in your configuration:
 
 ```bash
 # Claude Code
-claude mcp add --scope user --transport stdio codebase-context -- npx -y codebase-context@2.2.0
+claude mcp add --scope user --transport stdio codebase-context -- npx -y codebase-context@2.4.0
 
 # Codex CLI
-codex mcp add codebase-context -- npx -y codebase-context@2.2.0
+codex mcp add codebase-context -- npx -y codebase-context@2.4.0
 
 # OpenCode 1.x (keep the quoted separator on Windows)
-opencode mcp add codebase-context '--' npx -y codebase-context@2.2.0
+opencode mcp add codebase-context '--' npx -y codebase-context@2.4.0
 ```
 
 Start a new agent session in your project, then ask:
 
 > Use Codebase Context to find [feature] in this repository. Pass this repository's absolute path as project when checking get_indexing_status and searching. Wait for indexing if needed, read codebase://context, then search_codebase and open a returned source file. Show me the relevant files.
 
-Replace `[feature]` with something you want to find. The agent supplies the repository path in its tool calls, so the registration can serve different projects. Initial indexing may need a local model download. The October 6 isolated checks proved these client registrations and published-package project selection/search; they did not establish a full native agent investigation.
+Replace `[feature]` with something you want to find. The agent supplies the repository path in its tool calls, so the registration can serve different projects. Initial indexing may need a local model download. The October 6 isolated checks exercised published `2.2.0` client registrations and project selection/search. They did not verify `2.4.0` or establish a full native agent investigation.
 
 For Codex Desktop, create or merge `.codex/config.toml` in the project you want to search:
 
 ```toml
 [mcp_servers.codebase-context]
 command = "npx"
-args = ["-y", "codebase-context@2.2.0"]
+args = ["-y", "codebase-context@2.4.0"]
 startup_timeout_sec = 120
 ```
 
@@ -44,13 +44,13 @@ Other clients use their own setup commands:
 
 | Client                      | Shortest current setup                                                       |
 | --------------------------- | ---------------------------------------------------------------------------- |
-| Gemini CLI                  | `gemini mcp add --scope user codebase-context npx -y codebase-context@2.2.0` |
+| Gemini CLI                  | `gemini mcp add --scope user codebase-context npx -y codebase-context@2.4.0` |
 | Cursor                      | Add `.cursor/mcp.json`                                                       |
 | VS Code with GitHub Copilot | Add `.vscode/mcp.json`                                                       |
-| GitHub Copilot CLI          | `copilot mcp add codebase-context -- npx -y codebase-context@2.2.0` |
+| GitHub Copilot CLI          | `copilot mcp add codebase-context -- npx -y codebase-context@2.4.0` |
 | Windsurf                    | Add `~/.codeium/windsurf/mcp_config.json`                                    |
 
-Check an existing same-name entry before replacing it. To give the server a default folder, append that folder's absolute path to the `npx` arguments. The [client setup guide](./docs/client-setup.md) covers scopes, optional fixed-folder configuration, verification limits and the unreleased installer. Published `2.2.0`'s interactive `init` has registration bugs; use the commands above.
+Check an existing same-name entry before replacing it. To give the server a default folder, append that folder's absolute path to the `npx` arguments. The [client setup guide](./docs/client-setup.md) covers scopes, optional fixed-folder configuration, the `2.4.0` project installer and its verification limits. The registration bugs found in `2.2.0` are historical.
 
 The [client setup guide](./docs/client-setup.md) has the exact commands and config for every client, plus what was checked locally and what still relies on official instructions.
 
@@ -64,12 +64,16 @@ The default connection is `stdio` (standard input/output): your client starts th
 
 ### Team patterns and examples
 
-`get_team_patterns` shows the approaches used in the repository and points to representative files. Published `2.2.0` includes dedicated analyzers for Angular, React and Next.js, with a generic analyzer for other stacks. NestJS support belongs to the newer source candidate.
+`get_team_patterns` shows the approaches used in the repository and points to representative files. Published `2.4.0` includes dedicated analyzers for Angular, React, Next.js and NestJS, with a generic analyzer for other stacks.
 
 ### Project memory
 
 `remember` stores a convention, decision, gotcha, or past failure for the project. `get_memory` retrieves relevant entries in later sessions, including when the agent or editor changes.
 
+### Review context
+
+The `codebase-context-review` CLI creates a bounded context packet from a committed Git diff. It gives a reviewer context; it does not review code or prove review quality. See the [review-context guide](./docs/review-context.md).
+
 ## How it works
 
 1. **Index locally.** Codebase Context scans the project, builds a keyword index, and creates local semantic embeddings - numeric representations used to match code by meaning as well as exact words.
@@ -80,16 +84,16 @@ The same information is available from the terminal. Run these commands from you
 
 ```bash
 # Build or refresh the local index
-npx -y codebase-context@2.2.0 reindex
+npx -y codebase-context@2.4.0 reindex
 
 # Repository structure, patterns, and representative files
-npx -y codebase-context@2.2.0 map
+npx -y codebase-context@2.4.0 map
 
 # Ranked code search
-npx -y codebase-context@2.2.0 search --query "auth middleware"
+npx -y codebase-context@2.4.0 search --query "auth middleware"
 
 # Current team patterns
-npx -y codebase-context@2.2.0 patterns
+npx -y codebase-context@2.4.0 patterns
 ```
 
 One stdio server can route across several repositories. Supply `project` in tool calls to select the intended repository; a successful selection becomes the default for later calls in that process. Some clients also announce workspace roots: one root can auto-select, while an ambiguous selection asks for a project instead of guessing. MCP deprecated Roots in its July 2026 revision, so explicit project selection is the documented default rather than a dependency on client discovery.
@@ -145,8 +149,8 @@ The method and failures are documented so the measurements can be inspected with
 - Retrieval measurements describe expected-file coverage, file precision, and reported `peakPrivateGb`, not patch correctness or end-to-end coding quality.
 - The paired token observation covers two frozen investigation tasks and records observed agent behavior; it is not a universal token or time guarantee.
 - Setup checks differ by client. The detailed guide distinguishes a written config, a config recognized by the client, a local connection, and instructions checked only against official docs.
-- Published `2.2.0` has dedicated Angular, React and Next.js analyzers; NestJS support is in the newer source candidate. Other projects use the generic analyzer and the language parsers available for that stack.
-- The default searchable-chunk limit is 5,000 per project. Larger repositories can raise it in `.codebase-context/config.json`.
+- Published `2.4.0` has dedicated Angular, React, Next.js and NestJS analyzers. Other projects use the generic analyzer and the language parsers available for that stack.
+- The default searchable-chunk limit is 5,000 per project. In `~/.codebase-context/config.json`, set `projects[].parsing.maxChunks` for a project that needs a higher limit.
 - The agent must identify its repository in tool calls when no default or unambiguous client root is available. Concurrent HTTP client isolation is not established by the stdio routing checks.
 
 ## Reference
diff --git a/docs/capabilities.md b/docs/capabilities.md
index 748d5a1..536c736 100644
--- a/docs/capabilities.md
+++ b/docs/capabilities.md
@@ -8,8 +8,8 @@ The server supports two transport modes:
 
 | Mode                | Command                                           | MCP endpoint                 |
 | ------------------- | ------------------------------------------------- | ---------------------------- |
-| **stdio** (default) | `npx -y codebase-context@2.2.0`                   | Spawned process stdin/stdout |
-| **HTTP**            | `npx -y codebase-context@2.2.0 --http [--port N]` | `http://127.0.0.1:3100/mcp`  |
+| **stdio** (default) | `npx -y codebase-context@2.4.0`                   | Spawned process stdin/stdout |
+| **HTTP**            | `npx -y codebase-context@2.4.0 --http [--port N]` | `http://127.0.0.1:3100/mcp`  |
 
 HTTP defaults to `127.0.0.1:3100`. Override with `--port`, `CODEBASE_CONTEXT_PORT`, or `server.port` in `~/.codebase-context/config.json`.
 
@@ -20,13 +20,14 @@ Per-project config overrides supported today:
 - `projects[].excludePatterns`: merged with the built-in exclusion set for that project at index time
 - `projects[].analyzerHints.analyzer`: prefers a registered analyzer by name for that project and falls back safely when the name is missing or invalid
 - `projects[].analyzerHints.extensions`: adds project-local source extensions for indexing and auto-refresh watching without changing defaults for other projects
+- `projects[].parsing.maxChunks`: sets the maximum number of searchable chunks indexed for that project
 
 Copy-pasteable client config templates are shipped in the package:
 
 - `templates/mcp/stdio/.mcp.json` — stdio setup for `.mcp.json`-style clients
 - `templates/mcp/http/.mcp.json` — HTTP setup for `.mcp.json`-style clients
 
-Use Node.js 22 or newer with the published 2.2.0 commands shown here. For client registration recipes and their verification limits, see the [client setup guide](./client-setup.md).
+Use Node.js 22 or newer with the published 2.4.0 commands shown here. For client registration recipes and their verification limits, see the [client setup guide](./client-setup.md).
 
 ## CLI Reference
 
@@ -49,15 +50,15 @@ For a command gallery with examples, see `docs/cli.md`.
 | `memory add`           | `--type`, `--category`, `--memory`, `--reason`                                                             | `remember`                             |
 | `memory remove <id>`   | —                                                                                                          | —                                      |
 
-Commands that list `--json` above support raw JSON output. For MCP client registration, follow the [published client setup recipes](./client-setup.md); do not use the broken `init` setup command in published 2.2.0. Errors go to stderr with exit code 1.
+Commands that list `--json` above support raw JSON output. For MCP client registration, follow the [published client setup recipes](./client-setup.md). The registration failures documented for `init` apply to published 2.2.0; see that guide for current 2.4.0 setup instructions. Errors go to stderr with exit code 1.
 
 ```bash
 # Quick examples
-npx -y codebase-context@2.2.0 status
-npx -y codebase-context@2.2.0 search --query "auth middleware" --intent edit
-npx -y codebase-context@2.2.0 refs --symbol "UserService" --limit 10
-npx -y codebase-context@2.2.0 cycles --scope src/features
-npx -y codebase-context@2.2.0 reindex --incremental
+npx -y codebase-context@2.4.0 status
+npx -y codebase-context@2.4.0 search --query "auth middleware" --intent edit
+npx -y codebase-context@2.4.0 refs --symbol "UserService" --limit 10
+npx -y codebase-context@2.4.0 cycles --scope src/features
+npx -y codebase-context@2.4.0 reindex --incremental
 ```
 
 ## Tool Surface
@@ -301,6 +302,6 @@ Reproducible evaluation is shipped as a CLI entrypoint backed by shared scoring
 
 - **Symbol refs are not a call-graph.** `get_symbol_references` counts identifier-node occurrences in the AST (comments/strings excluded via Tree-sitter). It does not distinguish call sites from type annotations, variable assignments, or imports. Full call-site-specific analysis (`call_expression` nodes only) is a roadmap item.
 - **Impact is 2-hop max.** `computeImpactCandidates` walks direct importers then their importers. Full BFS reachability is on the roadmap.
-- **Published 2.2.0 has dedicated Angular, React, and Next.js analyzers.** NestJS support is in a newer source candidate and is not part of published 2.2.0. Other languages use the Generic analyzer (30+ languages, chunking + import graph, no framework-specific signal extraction).
+- **Published 2.4.0 has dedicated Angular, React, Next.js and NestJS analyzers.** Other languages use the Generic analyzer (30+ languages, chunking + import graph, no framework-specific signal extraction).
 - **Default embedding model is `bge-small-en-v1.5` (512-token context).** Granite (8192 context) is opt-in via `EMBEDDING_MODEL`. OpenAI is opt-in via `EMBEDDING_PROVIDER=openai` — sends code externally.
 - **Patterns are file-level frequency counts.** Not semantic clustering. Rising/Declining trend is derived from git commit recency for files using each pattern, not from usage semantics.
diff --git a/docs/cli.md b/docs/cli.md
index dfda760..d9dc407 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -10,18 +10,18 @@
 
 > Output depends on the repo you run it against. The examples below are illustrative (paths, counts, and detected frameworks will vary).
 >
-> These examples show an earlier CLI run; they do not verify the current package or an MCP connection.
+> These output examples come from an earlier CLI run; they were not captured from published `2.4.0` and do not verify an MCP connection.
 >
-> The commands below use published `codebase-context@2.2.0` and require Node.js 22 or newer. The CLI is intentionally single-project per invocation and targets one root via `CODEBASE_ROOT` or the current working directory. MCP registration and project selection are covered in the [client setup guide](./client-setup.md).
+> The commands below use published `codebase-context@2.4.0` and require Node.js 22 or newer. The CLI is intentionally single-project per invocation and targets one root via `CODEBASE_ROOT` or the current working directory. MCP registration and project selection are covered in the [client setup guide](./client-setup.md).
 
 ## How to run
 
 ```bash
 # CLI only: run from a repo root, or set CODEBASE_ROOT explicitly:
-CODEBASE_ROOT=/path/to/repo npx -y codebase-context@2.2.0 status
+CODEBASE_ROOT=/path/to/repo npx -y codebase-context@2.4.0 status
 
 # Commands that show --json in their help support machine output. Human mode is default.
-npx -y codebase-context@2.2.0 patterns --json
+npx -y codebase-context@2.4.0 patterns --json
 ```
 
 ### ASCII fallback
@@ -29,7 +29,7 @@ npx -y codebase-context@2.2.0 patterns --json
 If your terminal doesn’t render Unicode box-drawing cleanly:
 
 ```bash
-CODEBASE_CONTEXT_ASCII=1 npx -y codebase-context@2.2.0 patterns
+CODEBASE_CONTEXT_ASCII=1 npx -y codebase-context@2.4.0 patterns
 ```
 
 ## Commands
@@ -44,7 +44,7 @@ CODEBASE_CONTEXT_ASCII=1 npx -y codebase-context@2.2.0 patterns
 - `reindex` — rebuild index (full or incremental)
 - `style-guide` — find style guide sections in docs
 - `memory list|add|remove` — manage team memory (stored in `.codebase-context/memory.json`)
-- MCP client registration — use the published 2.2.0 commands in the [client setup guide](./client-setup.md); published `init` is not a reliable setup route
+- MCP client registration — use the published 2.4.0 recipes in the [client setup guide](./client-setup.md); the setup failures documented for `init` apply to 2.2.0
 
 ---
 
@@ -53,9 +53,9 @@ CODEBASE_CONTEXT_ASCII=1 npx -y codebase-context@2.2.0 patterns
 Run these CLI commands from the project root. Build or refresh the local index first; the first index may take a while while the project is scanned and local embeddings are created. Then inspect the conventions map and search for the code you need:
 
 ```bash
-npx -y codebase-context@2.2.0 reindex
-npx -y codebase-context@2.2.0 map
-npx -y codebase-context@2.2.0 search --query "auth middleware"
+npx -y codebase-context@2.4.0 reindex
+npx -y codebase-context@2.4.0 map
+npx -y codebase-context@2.4.0 search --query "auth middleware"
 ```
 
 This is the CLI preparation flow. It is separate from MCP client registration and does not by itself show that an MCP client connected successfully.
@@ -63,8 +63,8 @@ This is the CLI preparation flow. It is separate from MCP client registration an
 ## `map`
 
 ```bash
-npx -y codebase-context@2.2.0 reindex
-npx -y codebase-context@2.2.0 map
+npx -y codebase-context@2.4.0 reindex
+npx -y codebase-context@2.4.0 map
 ```
 
 The conventions map - run this first on an unfamiliar repo. It shows architecture layers, active patterns with adoption rates and trend direction, and the golden files the team treats as the strongest examples. This is also what the MCP server delivers to AI agents via the `codebase://context` resource on first call, before search narrows to a specific local example.
@@ -99,7 +99,7 @@ Example output (truncated):
 ## `metadata`
 
 ```bash
-npx -y codebase-context@2.2.0 metadata
+npx -y codebase-context@2.4.0 metadata
 ```
 
 Example output:
@@ -120,7 +120,7 @@ Example output:
 ## `patterns`
 
 ```bash
-npx -y codebase-context@2.2.0 patterns
+npx -y codebase-context@2.4.0 patterns
 ```
 
 Example output (truncated):
@@ -142,8 +142,8 @@ Example output (truncated):
 ## `search`
 
 ```bash
-npx -y codebase-context@2.2.0 reindex
-npx -y codebase-context@2.2.0 search --query "file watcher" --intent edit --limit 3
+npx -y codebase-context@2.4.0 reindex
+npx -y codebase-context@2.4.0 search --query "file watcher" --intent edit --limit 3
 ```
 
 Example output (truncated):
@@ -164,7 +164,7 @@ Example output (truncated):
 ## `refs`
 
 ```bash
-npx -y codebase-context@2.2.0 refs --symbol "startFileWatcher" --limit 10
+npx -y codebase-context@2.4.0 refs --symbol "startFileWatcher" --limit 10
 ```
 
 Example output (truncated):
@@ -183,7 +183,7 @@ Example output (truncated):
 ## `cycles`
 
 ```bash
-npx -y codebase-context@2.2.0 cycles --scope src
+npx -y codebase-context@2.4.0 cycles --scope src
 ```
 
 Example output:
@@ -199,7 +199,7 @@ Example output:
 ## `status`
 
 ```bash
-npx -y codebase-context@2.2.0 status
+npx -y codebase-context@2.4.0 status
 ```
 
 Example output:
@@ -218,8 +218,8 @@ Example output:
 ## `reindex`
 
 ```bash
-npx -y codebase-context@2.2.0 reindex
-npx -y codebase-context@2.2.0 reindex --incremental --reason "changed watcher logic"
+npx -y codebase-context@2.4.0 reindex
+npx -y codebase-context@2.4.0 reindex --incremental --reason "changed watcher logic"
 ```
 
 > **MCP server mode**: if you're running codebase-context as an MCP server (long-running process), the index auto-refreshes via a file watcher — you don't need to call `reindex` between edits. Use `reindex` for one-shot CLI runs or to force a full rebuild.
@@ -227,7 +227,7 @@ npx -y codebase-context@2.2.0 reindex --incremental --reason "changed watcher lo
 ## `style-guide`
 
 ```bash
-npx -y codebase-context@2.2.0 style-guide --query "naming"
+npx -y codebase-context@2.4.0 style-guide --query "naming"
 ```
 
 Example output:
@@ -240,14 +240,14 @@ No style guides found.
 ## `memory`
 
 ```bash
-npx -y codebase-context@2.2.0 memory list
-npx -y codebase-context@2.2.0 memory list --query "watcher"
+npx -y codebase-context@2.4.0 memory list
+npx -y codebase-context@2.4.0 memory list --query "watcher"
 
-npx -y codebase-context@2.2.0 memory add \
+npx -y codebase-context@2.4.0 memory add \
   --type gotcha \
   --category tooling \
   --memory "Use pnpm, not npm" \
   --reason "Workspace support and speed"
 
-npx -y codebase-context@2.2.0 memory remove <id>
+npx -y codebase-context@2.4.0 memory remove <id>
 ```
diff --git a/docs/client-setup.md b/docs/client-setup.md
index 7770e7f..384cef0 100644
--- a/docs/client-setup.md
+++ b/docs/client-setup.md
@@ -1,6 +1,6 @@
 # Client Setup
 
-Codebase Context runs as a local MCP server: a tool your AI editor or command-line client can call while it works. Register it without a fixed folder, then let the agent supply its current repository through the `project` tool parameter. These examples use published npm `2.2.0`.
+Codebase Context runs as a local MCP server: a tool your AI editor or command-line client can call while it works. Register it without a fixed folder, then let the agent supply its current repository through the `project` tool parameter. These recipes target published npm `2.4.0`.
 
 Use Node.js 22 or newer for these recipes. The package declares Node 18+, but native dependency requirements are narrower than that broad declaration; these checks do not establish Node 18.0 compatibility.
 
@@ -25,7 +25,7 @@ After registration, start a new agent session in your project and ask:
 
 > Use Codebase Context to find [feature] in this repository. Pass this repository's absolute path as project when checking get_indexing_status and searching. Wait for indexing if needed, read codebase://context, then search_codebase and open a returned source file. Show me the relevant files.
 
-The first index may take a while and download a local model. You can prepare it separately with `npx -y codebase-context@2.2.0 reindex` from the project folder. Index readiness, client connection and useful agent behavior are separate checks.
+The first index may take a while and download a local model. You can prepare it separately with `npx -y codebase-context@2.4.0 reindex` from the project folder. Index readiness, client connection and useful agent behavior are separate checks.
 
 ## Claude Code
 
@@ -38,13 +38,13 @@ The first index may take a while and download a local model. You can prepare it
 User setup:
 
 ```bash
-claude mcp add --scope user --transport stdio codebase-context -- npx -y codebase-context@2.2.0
+claude mcp add --scope user --transport stdio codebase-context -- npx -y codebase-context@2.4.0
 ```
 
 Optional shared project setup:
 
 ```bash
-claude mcp add --scope project --transport stdio codebase-context -- npx -y codebase-context@2.2.0
+claude mcp add --scope project --transport stdio codebase-context -- npx -y codebase-context@2.4.0
 ```
 
 `--scope project` writes shared `.mcp.json` and requires project-server approval. `--scope local` instead stores a private association for the current project in `~/.claude.json`; it does not write `.mcp.json`.
@@ -64,7 +64,7 @@ claude mcp add --scope project --transport stdio codebase-context -- npx -y code
 **Scope:** The command writes user config. A trusted project can use a project `.codex/config.toml` instead.
 
 ```bash
-codex mcp add codebase-context -- npx -y codebase-context@2.2.0
+codex mcp add codebase-context -- npx -y codebase-context@2.4.0
 ```
 
 Equivalent project config:
@@ -72,7 +72,7 @@ Equivalent project config:
 ```toml
 [mcp_servers.codebase-context]
 command = "npx"
-args = ["-y", "codebase-context@2.2.0"]
+args = ["-y", "codebase-context@2.4.0"]
 startup_timeout_sec = 120
 ```
 
@@ -82,28 +82,28 @@ startup_timeout_sec = 120
 
 **Official docs:** [Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp?surface=cli). The supported `startup_timeout_sec` option defaults to ten seconds; the project example allows 120 seconds for initial `npx` package preparation. This does not prove Desktop startup or guarantee completion of a cold download.
 
-## Codex Desktop: published 2.2.0
+## Codex Desktop: 2.4.0 recipe
 
 Create or merge `.codex/config.toml` in the project you want to search. Preserve any existing settings:
 
 ```toml
 [mcp_servers.codebase-context]
 command = "npx"
-args = ["-y", "codebase-context@2.2.0"]
+args = ["-y", "codebase-context@2.4.0"]
 startup_timeout_sec = 120
 ```
 
 Trust the project if asked, restart Codex and start a new task there. Use the first-use prompt above so the agent selects the current repository. The CLI command in the preceding section writes user-level config; this recipe uses a trusted project's config instead.
 
-**Verification boundary:** isolated Windows CLI and SDK/MCP checks on October 5 indexed a six-file fixture with published `2.2.0`, selected its project, retrieved context and found a source that the host could open. The exact `npx -y codebase-context@2.2.0 <project>` entrypoint also passed using a warmed isolated npm cache and prepared index. This does not establish a fully cold download or a fresh Codex Desktop agent session. The September Desktop session below used a packed candidate; keep it separate from published-package acceptance.
+**Verification boundary:** isolated Windows CLI and SDK/MCP checks on October 5 exercised published `2.2.0` on a six-file fixture; the exact `npx -y codebase-context@2.2.0 <project>` entrypoint passed with a warmed isolated npm cache and prepared index. This is historical evidence for `2.2.0`, not verification of `2.4.0`, a fully cold download or a fresh Codex Desktop agent session. The September Desktop session below used a packed candidate; keep it separate from published-package acceptance.
 
-On October 6 the exact published `npx` entrypoint was also tested without a folder, environment root or MCP roots, launched from an unrelated directory. Its first tool call returned `selection_required`; an explicit `project` call selected the prepared fixture, search found the expected symbol, context returned its map, and the runner host opened the returned source. A later call without `project` retained that selection. This is SDK/protocol and runner-host evidence with warmed caches and a pre-indexed fixture, not a native Desktop task.
+On October 6 the exact published `2.2.0` `npx` entrypoint was tested without a folder, environment root or MCP roots, launched from an unrelated directory. That check does not verify the `2.4.0` package. Its first tool call returned `selection_required`; an explicit `project` call selected the prepared fixture, search found the expected symbol, context returned its map, and the runner host opened the returned source. A later call without `project` retained that selection. This is SDK/protocol and runner-host evidence with warmed caches and a pre-indexed fixture, not a native Desktop task.
 
-## Unreleased installer candidate
+## Project-scoped installer in 2.4.0
 
-The next release is expected to support one project-only command from the target project:
+Published `2.4.0` includes a project-only setup command that you can run from the target project:
 
-The `init --client codex --yes` flow is an unreleased source candidate. Published npm `2.2.0` does not include these flags. Use the published configuration above rather than an `@latest` installer command; candidate verification uses an exact built or installed candidate.
+The `init --client codex --yes` flow was checked before release from an exact built or packed candidate. Those checks document that candidate; they do not verify the published `2.4.0` package. Use the version-pinned recipes above rather than an `@latest` installer command.
 
 A successful `init --client codex --yes` writes the project-scoped `.codex/config.toml` and prepares the index for that root. If config writing or index preparation fails, setup is incomplete and Codex is not ready to use.
 
@@ -119,21 +119,21 @@ node C:\path\to\codebase-context\dist\index.js init --client codex --yes
 
 Use `--root C:\path\to\project` when the command is run from elsewhere. Here, `root` means the project folder to configure and index. The candidate writes the project-scoped `<project>/.codex/config.toml`, preserves unrelated Codex settings, prepares the index for that folder, and does not write `AGENTS.md` or global client configuration. After a successful result, trust the project in Codex Desktop if prompted, restart or reopen Codex, start a new task in that project, and ask a small project question. A written config and ready index do not prove that Codex loaded or queried the server.
 
-Before release, the generated `npx` server command still resolves the published package unless the candidate is installed in the target project's `node_modules`. Our packaged test installs the candidate in a disposable project and checks its file hash. Running the built setup command alone does not prove that Codex will launch that same candidate.
+At candidate-check time, the generated `npx` server command resolved the published package unless the candidate was installed in the target project's `node_modules`. The packaged test installed the candidate in a disposable project and checked its file hash. Running the built setup command alone did not prove that Codex would launch that same candidate or that the published `2.4.0` package behaves identically.
 
-**Checked on 2026-09-15:** the packed candidate installed and indexed an isolated Windows project. A fresh Codex Desktop task then called the actual `search_codebase` MCP tool and located the requested chart component with its source file and lines. The normal Desktop task flow established project trust; no trust-file edits or replacement CLI/SDK search were used for that answer. This covers the small prepared project with shared caches, not a cold-machine install or the published npm package.
+**Checked on 2026-09-15:** the packed candidate installed and indexed an isolated Windows project. A fresh Codex Desktop task then called the actual `search_codebase` MCP tool and located the requested chart component with its source file and lines. The normal Desktop task flow established project trust; no trust-file edits or replacement CLI/SDK search were used for that answer. This covers the small prepared project with shared caches, not a cold-machine install or the published npm `2.4.0` package.
 
 ## Optional fixed-folder setup and CLI preparation
 
-To set a default project before the first tool call, append its full path to the server arguments, for example `args = ["-y", "codebase-context@2.2.0", "C:/projects/my-app"]`. Use a quoted literal shell argument in registration commands. This makes the default fixed across repositories when the registration is user-scoped; explicit tool selection can still choose another allowed project.
+To set a default project before the first tool call, append its full path to the server arguments, for example `args = ["-y", "codebase-context@2.4.0", "C:/projects/my-app"]`. Use a quoted literal shell argument in registration commands. This makes the default fixed across repositories when the registration is user-scoped; explicit tool selection can still choose another allowed project.
 
 To prepare the index separately, run from the project folder:
 
 ```powershell
-npx -y codebase-context@2.2.0 reindex
+npx -y codebase-context@2.4.0 reindex
 ```
 
-Do not use published `2.2.0`'s interactive `init` as the setup route. October 6 isolated checks found that it ignores `--help`, `--client` and `--yes`; its Claude/Codex registration executes `mcp` instead of the client executable, and its HTTP recipes require a separately started server. It can exit zero after registration fails. The unreleased installer above is a separate implementation.
+The setup failures below are specific to published `2.2.0`'s interactive `init`: October 6 isolated checks found that it ignores `--help`, `--client` and `--yes`; its Claude/Codex registration executes `mcp` instead of the client executable, and its HTTP recipes require a separately started server. It can exit zero after registration fails. These findings do not describe the `2.4.0` installer documented above.
 
 ## Gemini CLI
 
@@ -146,13 +146,13 @@ Do not use published `2.2.0`'s interactive `init` as the setup route. October 6
 User setup:
 
 ```bash
-gemini mcp add --scope user codebase-context npx -y codebase-context@2.2.0
+gemini mcp add --scope user codebase-context npx -y codebase-context@2.4.0
 ```
 
 Project setup:
 
 ```bash
-gemini mcp add --scope project codebase-context npx -y codebase-context@2.2.0
+gemini mcp add --scope project codebase-context npx -y codebase-context@2.4.0
 ```
 
 Gemini writes an `mcpServers` entry in its settings. Claude, Codex, and Copilot CLI use `--`; Gemini does not.
@@ -178,7 +178,7 @@ Create `.cursor/mcp.json`:
   "mcpServers": {
     "codebase-context": {
       "command": "npx",
-      "args": ["-y", "codebase-context@2.2.0"]
+      "args": ["-y", "codebase-context@2.4.0"]
     }
   }
 }
@@ -203,7 +203,7 @@ Checked config shape: `.cursor/mcp.json with mcpServers.codebase-context command
 Official user command:
 
 ```powershell
-code --add-mcp '{"name":"codebase-context","command":"npx","args":["-y","codebase-context@2.2.0"]}'
+code --add-mcp '{"name":"codebase-context","command":"npx","args":["-y","codebase-context@2.4.0"]}'
 ```
 
 Deterministic workspace config at `.vscode/mcp.json`:
@@ -213,7 +213,7 @@ Deterministic workspace config at `.vscode/mcp.json`:
   "servers": {
     "codebase-context": {
       "command": "npx",
-      "args": ["-y", "codebase-context@2.2.0"]
+      "args": ["-y", "codebase-context@2.4.0"]
     }
   }
 }
@@ -234,7 +234,7 @@ Deterministic workspace config at `.vscode/mcp.json`:
 **Scope:** User config.
 
 ```bash
-copilot mcp add codebase-context -- npx -y codebase-context@2.2.0
+copilot mcp add codebase-context -- npx -y codebase-context@2.4.0
 ```
 
 **What was checked:** The command ran with an isolated `--config-dir` and wrote the expected `mcp-config.json` command, arguments, and tool filter.
@@ -254,7 +254,7 @@ copilot mcp add codebase-context -- npx -y codebase-context@2.2.0
 Run once:
 
 ```bash
-opencode mcp add codebase-context '--' npx -y codebase-context@2.2.0
+opencode mcp add codebase-context '--' npx -y codebase-context@2.4.0
 ```
 
 Keep the quoted `'--'`: the installed Windows PowerShell npm shim consumes an unquoted separator. The quoted form also works in POSIX shells.
@@ -267,7 +267,7 @@ For a project-local alternative, merge this into `opencode.json`:
   "mcp": {
     "codebase-context": {
       "type": "local",
-      "command": ["npx", "-y", "codebase-context@2.2.0"],
+      "command": ["npx", "-y", "codebase-context@2.4.0"],
       "enabled": true,
       "timeout": 120000
     }
@@ -300,7 +300,7 @@ Create `~/.codeium/windsurf/mcp_config.json`:
   "mcpServers": {
     "codebase-context": {
       "command": "npx",
-      "args": ["-y", "codebase-context@2.2.0"]
+      "args": ["-y", "codebase-context@2.4.0"]
     }
   }
 }
@@ -319,8 +319,8 @@ Checked config shape: `~/.codeium/windsurf/mcp_config.json with mcpServers.codeb
 Use `stdio` for the simplest setup. HTTP can let several clients share one long-running local process, but support depends on the client and this path is not part of the default setup proof:
 
 ```bash
-npx -y codebase-context@2.2.0 --http
-npx -y codebase-context@2.2.0 --http --port 4000
+npx -y codebase-context@2.4.0 --http
+npx -y codebase-context@2.4.0 --http --port 4000
 ```
 
 The documented default endpoint is `http://127.0.0.1:3100/mcp`. Config-shape templates are available in [`templates/mcp/stdio/.mcp.json`](../templates/mcp/stdio/.mcp.json) and [`templates/mcp/http/.mcp.json`](../templates/mcp/http/.mcp.json); pin the published package as in the recipes above. HTTP does not discover a client's project folder; the agent still has to select its repository.
@@ -339,7 +339,7 @@ Some clients also announce workspace roots. One valid root can auto-select; seve
 
 [MCP deprecated Roots on July 28, 2026](https://modelcontextprotocol.io/specification/2026-07-28/client/roots), recommending explicit directories/files in tool parameters, resource URIs or server configuration. CBC's older Roots support remains a compatibility aid rather than a required setup step.
 
-October 6 verification: 18 focused current-source routing tests passed, including ambiguous roots, explicit selection, subsequent calls and root changes. The exact published server also switched between two isolated prepared repositories A to B to A in one no-roots stdio process: search paths, context map and subsequent status calls followed each selection. The runner host opened the expected distinct sources. A native agent session across real repositories remains a validation step; stdio process-local selection does not establish concurrent HTTP isolation.
+October 6 verification: 18 focused current-source routing tests passed, including ambiguous roots, explicit selection, subsequent calls and root changes. The exact published `2.2.0` server also switched between two isolated prepared repositories A to B to A in one no-roots stdio process; search paths, context map and subsequent status calls followed each selection, and the runner host opened the expected distinct sources. This historical package check does not verify published `2.4.0` or establish concurrent HTTP isolation. A native agent session across real repositories remains a validation step.
 
 A follow-up recorded raw `search_codebase` calls containing only `query` and `mode`, with no `project`: they returned A, B and A after those explicit selections. The caller does not automatically add the full path; CBC routes omitted-project calls using its selected project. This state lasts for that stdio process. Select again after a server restart or when changing repositories.
 
diff --git a/docs/demo.md b/docs/demo.md
index 8b06f23..926860a 100644
--- a/docs/demo.md
+++ b/docs/demo.md
@@ -2,14 +2,14 @@
 
 This walkthrough shows real CLI output captured from the open-source `angular-spotify` repository during a local proof run. That sample checkout is not bundled here.
 
-To try the same CLI flow, use Node.js 22 or newer and open a terminal in the repository you want to inspect. These commands use published `codebase-context@2.2.0`; the CLI uses the current directory as the project root. MCP registration and project selection are covered in the [client setup guide](./client-setup.md).
+To try the same CLI flow, use Node.js 22 or newer and open a terminal in the repository you want to inspect. These commands target published `codebase-context@2.4.0`; the CLI uses the current directory as the project root. MCP registration and project selection are covered in the [client setup guide](./client-setup.md).
 
-The saved output below is from an earlier CLI run, not the published-package commands shown here. The machine-specific repository root is omitted from the returned file path. This capture does not verify the current package or an MCP connection.
+The saved output below is from an earlier CLI run, not from published `2.4.0` or the commands shown here. The machine-specific repository root is omitted from the returned file path. This capture does not verify the current package or an MCP connection.
 
 ## 0. Build The Local Index
 
 ```bash
-npx -y codebase-context@2.2.0 reindex
+npx -y codebase-context@2.4.0 reindex
 ```
 
 Run this before the first map or search in a repository. Later runs can use `reindex --incremental` after the code changes.
@@ -17,7 +17,7 @@ Run this before the first map or search in a repository. Later runs can use `rei
 ## 1. Start With The Conventions Map
 
 ```bash
-npx -y codebase-context@2.2.0 map --json
+npx -y codebase-context@2.4.0 map --json
 ```
 
 Captured output excerpt:
@@ -50,7 +50,7 @@ What this shows:
 ## 2. Search With Edit Intent
 
 ```bash
-npx -y codebase-context@2.2.0 search --query "auth headers" --intent edit --limit 3 --json
+npx -y codebase-context@2.4.0 search --query "auth headers" --intent edit --limit 3 --json
 ```
 
 Captured output excerpt:
@@ -91,7 +91,7 @@ What this shows:
 ## 3. Check A Team Pattern Directly
 
 ```bash
-npx -y codebase-context@2.2.0 patterns --category state --json
+npx -y codebase-context@2.4.0 patterns --category state --json
 ```
 
 Captured output excerpt:
diff --git a/docs/review-context.md b/docs/review-context.md
index e35df6a..f1ae2e2 100644
--- a/docs/review-context.md
+++ b/docs/review-context.md
@@ -26,13 +26,13 @@ node dist/review-bin.js --base origin/main --head HEAD
 After package publication, the package also exposes:
 
 ```bash
-npx codebase-context-review --base origin/main --head HEAD
+npm exec --yes --package=codebase-context@2.4.0 -- codebase-context-review --base origin/main --head HEAD
 ```
 
 Use `--json` for the complete machine-readable packet:
 
 ```bash
-npx codebase-context-review \
+npm exec --yes --package=codebase-context@2.4.0 -- codebase-context-review \
   --base origin/main \
   --head HEAD \
   --max-queries 8 \

From 33f27df02d9e8b9c70f0c792480d85fee811c172 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Rossell=C3=B3=20Colom?=
 <74001504+PatrickSys@users.noreply.github.com>
Date: Tue, 6 Oct 2026 16:09:22 +0200
Subject: [PATCH 3/3] fix: align release workflow with 2.4.0

---
 .github/workflows/publish-npm-on-release.yml | 4 ++--
 docs/client-setup.md                         | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish-npm-on-release.yml b/.github/workflows/publish-npm-on-release.yml
index 4ca7cf4..9b964d7 100644
--- a/.github/workflows/publish-npm-on-release.yml
+++ b/.github/workflows/publish-npm-on-release.yml
@@ -8,9 +8,9 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Tag to publish (e.g. v2.3.0)'
+        description: 'Tag to publish (e.g. v2.4.0)'
         required: true
-        default: 'v2.3.0'
+        default: 'v2.4.0'
 
 permissions:
   contents: read
diff --git a/docs/client-setup.md b/docs/client-setup.md
index 384cef0..b1af9bd 100644
--- a/docs/client-setup.md
+++ b/docs/client-setup.md
@@ -339,7 +339,7 @@ Some clients also announce workspace roots. One valid root can auto-select; seve
 
 [MCP deprecated Roots on July 28, 2026](https://modelcontextprotocol.io/specification/2026-07-28/client/roots), recommending explicit directories/files in tool parameters, resource URIs or server configuration. CBC's older Roots support remains a compatibility aid rather than a required setup step.
 
-October 6 verification: 18 focused current-source routing tests passed, including ambiguous roots, explicit selection, subsequent calls and root changes. The exact published `2.2.0` server also switched between two isolated prepared repositories A to B to A in one no-roots stdio process; search paths, context map and subsequent status calls followed each selection, and the runner host opened the expected distinct sources. This historical package check does not verify published `2.4.0` or establish concurrent HTTP isolation. A native agent session across real repositories remains a validation step.
+October 6 verification: 18 focused current-source routing tests passed, including ambiguous roots, explicit selection, subsequent calls and root changes. The exact published `2.2.0` server also switched between two isolated prepared repositories A to B to A in one no-roots stdio process; search paths, context map and subsequent status calls followed each selection, and the runner host opened the expected distinct sources. This historical package check does not verify published `2.4.0` or establish concurrent HTTP isolation. A native agent session across real repositories remains a validation step; stdio process-local selection does not establish concurrent HTTP isolation.
 
 A follow-up recorded raw `search_codebase` calls containing only `query` and `mode`, with no `project`: they returned A, B and A after those explicit selections. The caller does not automatically add the full path; CBC routes omitted-project calls using its selected project. This state lasts for that stdio process. Select again after a server restart or when changing repositories.