Skip to content

Release: marketing site to main#149

Merged
dvcdsys merged 22 commits into
mainfrom
develop
Jul 19, 2026
Merged

Release: marketing site to main#149
dvcdsys merged 22 commits into
mainfrom
develop

Conversation

@dvcdsys

@dvcdsys dvcdsys commented Jul 19, 2026

Copy link
Copy Markdown
Owner

Brings develop into main. Headline change is the CodeIndeX marketing site
(site/) — a static Vite build (landing + /docs/) targeting Cloudflare Pages.
The site carries no version or tag of its own and does not affect versioning of
anything in the stack.

What lands

  • site/ — full content written against the real product (31 tree-sitter
    grammars, rjeczalik/notify, real auth model, workspaces as a flagship feature,
    MCP/Cowork, GitHub-backed repos, managed tunnels). Demo terminal output is
    transcribed from real cix runs.
  • Docs page re-audited section-by-section against the source — the dead
    CIX_WORKSPACES_ENABLED flag is gone, the 503 entry names the real cause, and
    the watcher log path / cix def --limit / >= 0.65 band / /api/v1
    webhook-info prefix are corrected. workspaces.md gets the same treatment.
  • ci-site.yml — build gate, a grep of the built output for known-false
    claims, and a version-consistency gate that pins versions.js to the
    newest server/v* / cli/v* tags (not merely "a tag that exists", which
    had let the site advertise 0.12.2 after server/v0.12.3 shipped).
  • release-server.yml — the stale "upgrading from the Python backend" line
    is out of the release-notes template (the Python backend was archived in
    April), and a non-blocking site-version job warns at release time when the
    site still advertises the previous version.
  • Assorted Dependabot updates that had only existed locally.

All PR checks were green on #147 (build site, version gate, server tests on
ubuntu + macos).

🤖 Generated with Claude Code

dependabot Bot and others added 22 commits July 6, 2026 14:54
@dependabot
chore(deps): bump docker/login-action from 4.3.0 to 4.4.0
e6835b1 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@c99871d...af1e73f)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2
7cc191c 
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@718ea10...3d0d988)

---
updated-dependencies:
- dependency-name: softprops/action-gh-release
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump the go group across 1 directory with 5 updates
9cf6641 
Bumps the go group with 4 updates in the /server directory: [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi), [github.com/go-chi/chi/v5](https://github.com/go-chi/chi), [github.com/oapi-codegen/runtime](https://github.com/oapi-codegen/runtime) and [golang.org/x/crypto](https://github.com/golang/crypto).


Updates `github.com/getkin/kin-openapi` from 0.140.0 to 0.142.0
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](getkin/kin-openapi@v0.140.0...v0.142.0)

Updates `github.com/go-chi/chi/v5` from 5.3.0 to 5.3.1
- [Release notes](https://github.com/go-chi/chi/releases)
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md)
- [Commits](go-chi/chi@v5.3.0...v5.3.1)

Updates `github.com/oapi-codegen/runtime` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/oapi-codegen/runtime/releases)
- [Commits](oapi-codegen/runtime@v1.4.2...v1.5.0)

Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0
- [Commits](golang/crypto@v0.53.0...v0.54.0)

Updates `golang.org/x/sync` from 0.21.0 to 0.22.0
- [Commits](golang/sync@v0.21.0...v0.22.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.142.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: github.com/go-chi/chi/v5
  dependency-version: 5.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go
- dependency-name: github.com/oapi-codegen/runtime
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/crypto
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
- dependency-name: golang.org/x/sync
  dependency-version: 0.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
chore(deps): bump the npm group in /server/dashboard with 12 updates
963503f 
---
updated-dependencies:
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.1.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-dropdown-menu"
  dependency-version: 2.1.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-radio-group"
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-scroll-area"
  dependency-version: 1.2.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-select"
  dependency-version: 2.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-slider"
  dependency-version: 1.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-switch"
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-tabs"
  dependency-version: 1.1.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@radix-ui/react-tooltip"
  dependency-version: 1.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 22.20.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: postcss
  dependency-version: 8.5.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dvcdsys
Merge remote-tracking branch 'origin/dependabot/github_actions/develo…
5a0a7b2 
…p/softprops/action-gh-release-3.0.2' into develop
@dvcdsys
Merge remote-tracking branch 'origin/dependabot/github_actions/develo…
0c901f8 
…p/docker/login-action-4.4.0' into develop
@dvcdsys
Merge remote-tracking branch 'origin/dependabot/go_modules/server/dev…
5cf4565 
…elop/go-1366109be5' into develop
@dvcdsys
Merge remote-tracking branch 'origin/dependabot/npm_and_yarn/server/d…
3b73182 
…ashboard/develop/npm-303cd86870' into develop
@dvcdsys @claude
feat(site): CodeIndeX marketing site — Vite build for Cloudflare Pages
2329a1e 
Replace the designer prototype (dev React + in-browser Babel from unpkg)
with a production Vite 8 + React 18 multi-page site (/ and /docs/) under
site/. All facts verified against the codebase: server v0.12.2, CLI
v0.10.0, plugin v0.3.0, 31 tree-sitter grammars, hybrid BM25+dense; the
terminal demos are transcribed from real `cix` runs on this repository.
New docs sections cover workspaces, MCP (Claude Desktop/Cowork), the
Claude Code plugin, GitHub-backed repos + managed tunnels, and the full
auth/access model.

Ships self-hosted latin-only fonts (strict CSP via public/_headers),
favicon + OG image, and ci-site.yml (build gate + forbidden-claims grep
+ version-consistency check against plugin.json and release tags).

Also anchors the .gitignore `docs/` and `tmp` patterns to the repo root:
the bare `docs/` was silently excluding the new site/docs/ entry point —
the same pitfall previously documented for server/.gitignore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
docs: brand pass — canonical name CodeIndeX, link codeindex.app
23d7d65 
One canonical full-name spelling everywhere: CodeIndeX (cix is the
abbreviation/command; codeindex.app and code-index are the same name in
medium-specific forms). Adds the website link to README and CITATION.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
feat(site): workspace demo — agent chat + live command pane
37e20bd 
Dedicated landing section for workspaces: a two-pane scripted demo where
the user asks a cross-repo question in an agent chat while the right pane
shows the cix ws command the agent actually runs, with ranked projects
(bm25/dense signals) and chunks. Abstract 4-repo scenario (acme-*) —
labeled as scripted; the output format mirrors the real CLI renderSearch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
feat(site): deepen workspace demo — multi-step agent investigation
dedae4a 
Feedback rework: drop the repo-count framing (workspaces have no limit;
headline now "All your repos", chips note "any number of repos") and
replace the single-lookup scenario with a real agent workflow: one minimal
question ("How do I add a new fee to checkout?") → workspace-wide hybrid
search surfaces three services → interim agent note → targeted per-repo
lookups (cix symbols / cix search -n) → a concrete answer naming the exact
symbols to change and the cache to invalidate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
feat(site): workspace demo — DB discovery, dead-end step, SQL in the …
922a9f2 
…answer

Deepen the scripted investigation: the agent now discovers fees are
DB-backed (CREATE TABLE migration + LoadSchedule), hits an honest dead end
(cix search in acme-web → "No results found", the CLI's literal empty
message), and answers with the exact INSERT to run plus a note that no
admin UI exists — so the row goes straight into the database. Both panes
are fixed-height and auto-scroll pinned to the bottom while the session
streams, like a real terminal/chat.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
feat(site): workspace demo polish — one-search context, code bodies, …
f0853e5 
…play/stop

- The broad workspace search now returns Top chunks alongside the projects
  panel (LoadSchedule, QuoteCache.Invalidate, the fees migration) — the
  cache is discovered by context in one query, not by a separate search;
  the deep dive into acme-billing streams fenced code bodies (CREATE TABLE
  is visibly where the INSERT columns come from).
- The user message opens with the plugin's real /cix-workspace slash
  command, rendered as a command chip.
- Play/stop controls on both animated demos (hero terminal + workspace):
  stop skips straight to the finished state, play restarts the loop.
  role=img moved off the containers that now hold buttons.
- Workspaces no longer framed as experimental anywhere on the site.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
docs: workspaces are no longer experimental
1d79629 
Replace the Experimental warning in workspaces.md with a neutral note
about the CIX_WORKSPACES_ENABLED flag, and drop the stale roadmap bullet
about planned workspace ACLs — owner scoping + view-group sharing shipped
(requireWorkspaceVisible / requireWorkspaceOwnership, /workspaces/{id}/shares).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@dvcdsys @claude
fix(server): bundle CPU llama.cpp sidecar so semantic search works ou…
ae8c1ec 
…t of the box

Forward-port of the fix released as server/v0.12.3 (shipped from main) so the
next develop->main release does not regress the CPU image back to the broken
state (no llama-server binary + static-debian12 base with no glibc + root-owned
/data/models). See the main commit for the full rationale; identical Dockerfile
changes here.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@dvcdsys @claude
chore(release): drop stale "upgrading from the Python backend" line f…
61bcaeb 
…rom release notes

The Python backend was archived 2026-04-24; every server release since has still
carried a "See doc/MIGRATION_FROM_PYTHON.md if upgrading from the Python backend"
line in its GitHub release body via this template. Remove it — the Docker-images
table plus the auto-generated changelog are the whole body now.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@dvcdsys @claude
feat(site): workspace demo controls, agent-first quickstart, docs rec…
bd1f9fe 
…onciled with code

Accumulated review batch:

- docs: 12-section re-audit against the source. Drop the dead
  CIX_WORKSPACES_ENABLED flag (removed in the 0.4.x line — workspaces ship in
  every release), rewrite the 503 troubleshooting entry (it is the github-token
  encryption layer failing to wire, not a feature flag), fix the watcher log
  path to ~/.cix/logs/watcher-<hash>.log, add --limit to `cix def`, correct the
  exact-match score band to ">= 0.65" (SEARCH_ALGORITHM.md warns 0.80 is a
  generic-model number), note that every MCP tool except cix_list_servers takes
  a server argument, and add the missing /api/v1 prefix to the webhook-info
  route.
- landing: rework the quickstart around getting an agent running (plugin
  install, the slash commands, the /cix and /cix-workspace skills) instead of
  clone-to-first-search; add a `cix ws search` tab to the CLI tour; stop
  calling workspaces experimental — they are a flagship feature.
- workspace demo: open with the real /cix-workspace slash command and trim the
  narration down to the essentials.
- both demos get play/stop controls (stop jumps straight to the final state).
- new use-frame-timeouts.js: requestAnimationFrame-based scheduling, so the
  demos no longer hang after a single play — browsers clamp setTimeout in
  backgrounded tabs, which stalled the scripted steps mid-run.
- workspaces.md: the same CIX_WORKSPACES_ENABLED removal (8 spots) and the
  experimental warning dropped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@dvcdsys @claude
ci(site): gate site versions against the NEWEST release tag, not mere…
305e957 
…ly an existing one

Two gaps would have let the published site advertise stale versions right
after a release — exactly what happens on a deploy following server/v0.12.3:

1. versions.js still said SERVER_VERSION 0.12.2. Bump it to 0.12.3.
2. The version-consistency gate only asserted that the server/CLI versions
   were *existing* release tags. 0.12.2 is a real tag, so a stale value sailed
   through and the site would have deployed advertising the previous release.
   Compare against the newest semver tag per release stream instead, and say
   so in the failure message.

Also fix the `v()` helper while here: its unanchored grep for PLUGIN_VERSION
also matched the COWORK_PLUGIN_VERSION line, so $PLUGIN came out two-valued
and the plugin comparison would have failed unconditionally on this gate's
first real run (it has never executed — the site branch is still unpushed).
Anchor the pattern on the full `export const <NAME> =` declaration.

Verified locally against the real tag list: server 0.12.3 / cli 0.10.0 /
plugin 0.3.0 all match, a simulated stale 0.12.2 is caught, and the site
build plus the forbidden-strings gate stay green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@dvcdsys @claude
ci(release): warn when the site still advertises the previous release
3a09076 
The marketing site is the one surface a release never touches, so it silently
keeps showing the old version — site/src/shared/versions.js still said 0.12.2
the moment server/v0.12.3 shipped. ci-site.yml hard-fails on a stale
versions.js, but it only triggers on site/** changes, so a server release
never runs it.

Add a site-version job that compares versions.js against the version being
released and emits a warning plus a step summary when they differ.
Non-blocking on purpose: versions.js may only name an already-tagged version,
so the bump legitimately lands after this tag exists — the warning is the
reminder to go do it, not a failure. Guards on the file's existence, since
site/ has not merged to main yet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@dvcdsys
Merge pull request #147 from dvcdsys/feat/site
7c495c6 
feat(site): CodeIndeX marketing site — Vite build, Cloudflare Pages
@dvcdsys @claude
fix(server): bump go directive to 1.25.12 for GO-2026-5856
50e4a29 
govulncheck flags GO-2026-5856 (Encrypted Client Hello privacy leak in
crypto/tls), present in the go1.25.11 standard library pinned by this go.mod
and fixed in go1.25.12. CI installs its toolchain from this file
(`go-version-file: server/go.mod`), so bumping the directive is what actually
moves the scanned stdlib.

Not a regression from any recent change — a newly published advisory against
the pinned patch release. The shipped image is unaffected either way: it builds
on golang:1.26-alpine.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@dvcdsys
dvcdsys merged commit 1f6a9e7 into main Jul 19, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dvcdsys