Merge remote-tracking branch 'origin/main' into fix-issue1472-1615-1616

# Conflicts:
#	src/CodeIndex/Mcp/McpToolHandlers.cs

Author: Widthdom

.github/workflows/release.yml

@@ -268,6 +268,63 @@ jobs:
         shell: pwsh
         run: Get-ChildItem publish -Filter *.pdb -Recurse | Remove-Item
 
+      - name: Authenticode sign Windows executable
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          WIN_SIGNING_CERT_BASE64: ${{ secrets.WIN_SIGNING_CERT_BASE64 }}
+          WIN_SIGNING_CERT_PASSWORD: ${{ secrets.WIN_SIGNING_CERT_PASSWORD }}
+        run: |
+          if ([string]::IsNullOrWhiteSpace($env:WIN_SIGNING_CERT_BASE64)) {
+            throw "WIN_SIGNING_CERT_BASE64 secret is required to Authenticode-sign Windows release binaries."
+          }
+          if ([string]::IsNullOrWhiteSpace($env:WIN_SIGNING_CERT_PASSWORD)) {
+            throw "WIN_SIGNING_CERT_PASSWORD secret is required to Authenticode-sign Windows release binaries."
+          }
+
+          $exe = Join-Path (Resolve-Path publish) "cdidx.exe"
+          if (-not (Test-Path -LiteralPath $exe)) {
+            throw "Published Windows executable was not found: $exe"
+          }
+
+          $pfxPath = Join-Path $env:RUNNER_TEMP "cdidx-signing.pfx"
+          [IO.File]::WriteAllBytes($pfxPath, [Convert]::FromBase64String($env:WIN_SIGNING_CERT_BASE64))
+
+          $password = ConvertTo-SecureString $env:WIN_SIGNING_CERT_PASSWORD -AsPlainText -Force
+          $cert = Import-PfxCertificate `
+            -FilePath $pfxPath `
+            -CertStoreLocation Cert:\CurrentUser\My `
+            -Password $password `
+            -Exportable:$false
+          try {
+            if (-not $cert.Thumbprint) {
+              throw "Imported signing certificate did not expose a thumbprint."
+            }
+
+            $signtool = Get-ChildItem "${env:ProgramFiles(x86)}\Windows Kits\10\bin" -Recurse -Filter signtool.exe |
+              Where-Object { $_.FullName -match '\\x64\\signtool\.exe$' } |
+              Sort-Object FullName -Descending |
+              Select-Object -First 1
+            if (-not $signtool) {
+              throw "signtool.exe was not found in the Windows Kits installation."
+            }
+
+            & $signtool.FullName sign /fd SHA256 /td SHA256 /tr http://timestamp.digicert.com /sha1 $cert.Thumbprint $exe
+            if ($LASTEXITCODE -ne 0) {
+              throw "signtool sign failed with exit code $LASTEXITCODE."
+            }
+
+            & $signtool.FullName verify /pa /v $exe
+            if ($LASTEXITCODE -ne 0) {
+              throw "signtool verify failed with exit code $LASTEXITCODE."
+            }
+          } finally {
+            if ($cert.Thumbprint) {
+              Remove-Item -LiteralPath "Cert:\CurrentUser\My\$($cert.Thumbprint)" -Force -ErrorAction SilentlyContinue
+            }
+            Remove-Item -LiteralPath $pfxPath -Force -ErrorAction SilentlyContinue
+          }
+
       - name: Add license and trademark notices to publish output (Linux/macOS)
         if: runner.os != 'Windows'
         run: cp LICENSE LICENSES/FSL-1.1-ALv2.txt LICENSES/Apache-2.0.txt COMMERCIAL_LICENSE.md INTEGRATION_POLICY.md TRADEMARKS.md publish/ && cp -R LICENSES publish/

README.md

@@ -233,6 +233,14 @@ the per-platform `CodeIndex-<rid>.tar.gz` / `.zip` binaries:
 | `sha256sums.txt` | SHA-256 of every release asset (including the SBOM). `install.sh` uses it to verify the downloaded tarball before placing anything under `$HOME/.local/bin/`. |
 | `cdidx.sbom.cdx.json` | CycloneDX 1.x JSON Software Bill of Materials covering every NuGet dependency (including the bundled `SQLitePCLRaw` native asset) so compliance reviewers (SOC2, FedRAMP-style) and scanners (Snyk, Trivy, Grype) can audit transitive dependencies without re-deriving them from `.deps.json`. |
 
+Windows ZIP releases contain an Authenticode-signed `cdidx.exe`. After
+extracting the archive on Windows, verify the signature and timestamp before
+trusting the executable:
+
+```powershell
+Get-AuthenticodeSignature .\cdidx.exe | Format-List Status,SignerCertificate,TimeStamperCertificate
+```
+
 Quick check after downloading both files from the release page:
 
 ```bash
@@ -457,6 +465,14 @@ NuGet パッケージは .NET グローバルツールとして公開されて
 | `sha256sums.txt` | 各リリースアセット（SBOM を含む）の SHA-256。`install.sh` は `$HOME/.local/bin/` に何も書き込む前に tarball をこのファイルで検証します。 |
 | `cdidx.sbom.cdx.json` | CycloneDX 1.x JSON 形式の Software Bill of Materials。同梱の `SQLitePCLRaw` ネイティブアセットを含む全 NuGet 依存を列挙するため、SOC2 / FedRAMP 系のコンプライアンスレビューや Snyk / Trivy / Grype などのスキャナーが `.deps.json` から再構築せずに推移的依存を監査できます。 |
 
+Windows ZIP release に含まれる `cdidx.exe` は Authenticode 署名済みです。
+Windows で archive を展開したあと、実行ファイルを信頼する前に署名と
+timestamp を確認してください。
+
+```powershell
+Get-AuthenticodeSignature .\cdidx.exe | Format-List Status,SignerCertificate,TimeStamperCertificate
+```
+
 リリースページから両ファイルをダウンロードしたあとの簡易チェック例:
 
 ```bash

USER_GUIDE.md

@@ -450,6 +450,13 @@ sha256sum -c sha256sums.txt
 The GPG signature verifies the checksum manifest through the release signing
 key.
 
+Windows release ZIPs also contain an Authenticode-signed `cdidx.exe`. After
+extracting the archive, verify that Windows trusts the signature and timestamp:
+
+```powershell
+Get-AuthenticodeSignature .\cdidx.exe | Format-List Status,SignerCertificate,TimeStamperCertificate
+```
+
 Release workflows also emit GitHub build provenance attestations for the
 published archives, SBOM, checksum manifest, and checksum signature. Verify
 that an artifact was produced by this repository's GitHub Actions release
@@ -633,6 +640,7 @@ cdidx ./myproject
 cdidx ./myproject --rebuild     # full rebuild from scratch
 cdidx ./myproject --verbose     # show per-file details
 cdidx ./myproject --duration-format seconds  # show elapsed time as seconds
+cdidx ./myproject --notify=osc9 # terminal notification after long runs
 cdidx ./myproject --watch       # stay running and reindex on file changes
 cdidx ./myproject --watch --debounce 200   # coalesce bursts within a 200 ms window
 ```
@@ -678,7 +686,9 @@ Done.
 
 During long-running indexing on an interactive terminal, `Indexing...` stays live as a spinner instead of dropping to a fixed line until the next 50-file progress update. Warnings still print immediately, but the spinner resumes right after each warning so the run does not look frozen. When stdout is redirected (for example `cdidx . > out.txt`), cdidx prints a single `Indexing...` line to stdout, keeps warnings on stderr, and emits only line-based progress updates to stdout.
 
-Human output formats elapsed index time with unit labels by default: milliseconds under 1 second, seconds under 1 minute, minutes/seconds under 1 hour, and hours/minutes/seconds after that. Use `--duration-format seconds` for decimal seconds or `--duration-format hms` for the legacy `HH:MM:SS` display. JSON output continues to expose raw `elapsed_ms` for machine consumers.
+Human output uses invariant numeric formatting (`.` decimal separator and `,` thousands separators) regardless of the process locale, matching JSON's culture-independent contract. Elapsed index time uses unit labels by default: milliseconds under 1 second, seconds under 1 minute, minutes/seconds under 1 hour, and hours/minutes/seconds after that. Use `--duration-format seconds` for decimal seconds or `--duration-format hms` for the legacy `HH:MM:SS` display. JSON output continues to expose raw `elapsed_ms` for machine consumers.
+
+For index runs that take at least five seconds, `--notify=<auto|bell|osc9|desktop|none>` controls a completion signal on stderr. `auto` rings the terminal bell only for interactive terminals and stays silent for redirected output; `desktop` currently maps to OSC 9 terminal notification text for terminals that support it. `CDIDX_NOTIFY` sets the same default, and `--quiet` suppresses completion notifications.
 
 Machine-readable output also reports the post-run readiness bits directly:
 
@@ -2323,6 +2333,7 @@ name-based tools では `exactName` を使い、`exact` は後方互換 client 
 | Search snippet lines | `8`（`--snippet-lines`、最大 `20`） | CLI help と search runner |
 | Max line width | `512`（`--max-line-width`、`0` で無効） | `LineWidthFormatter.DefaultMaxLineWidth` |
 | Index max file size | `CDIDX_MAX_FILE_BYTES` 未設定時は `4MiB` | index runner help |
+| Index completion notification | `auto`（interactive terminal は bell、redirected output は none）。`--notify` / `CDIDX_NOTIFY` で上書き | index runner help |
 | Watch debounce | `500` ms（`--debounce`） | index watch runner |
 | Status stale-after hint | `24h`。`--stale-after` / `CDIDX_STALE_AFTER` / `.cdidxrc.json` で上書き | status runner |
 | Color mode | `auto`。`--color` / `CLICOLOR_FORCE` / `NO_COLOR` / `CLICOLOR=0` で上書き | `ConsoleUi` |
@@ -2437,6 +2448,39 @@ runtime の管理方法とネットワーク条件に合わせて install channe
 完全な比較、package maintainer guidance、winget / apt / rpm / Snap /
 Flatpak などの予定チャネルは [DISTRIBUTION.md](DISTRIBUTION.md) を参照してください。
 
+### リリースアセットの検証
+
+GitHub releases は、すべての archive と SBOM asset を対象にした
+`sha256sums.txt` と、detached GPG signature の `sha256sums.txt.asc` を
+公開します。download した release artifact を信頼する前に checksum manifest
+を検証してください。
+
+```bash
+gpg --verify sha256sums.txt.asc sha256sums.txt
+sha256sum -c sha256sums.txt
+```
+
+GPG signature は release signing key を通じて checksum manifest を検証します。
+
+Windows release ZIP にも Authenticode 署名済みの `cdidx.exe` が含まれます。
+archive を展開したあと、Windows が署名と timestamp を信頼していることを
+確認してください。
+
+```powershell
+Get-AuthenticodeSignature .\cdidx.exe | Format-List Status,SignerCertificate,TimeStamperCertificate
+```
+
+release workflow は、公開された archive、SBOM、checksum manifest、checksum
+signature に対する GitHub build provenance attestation も出力します。artifact が
+この repository の GitHub Actions release workflow で生成されたことを検証できます。
+
+```bash
+gh attestation verify CodeIndex-linux-x64.tar.gz -R Widthdom/CodeIndex
+```
+
+GitHub attestation は、その artifact が repository workflow identity により
+生成されたことを検証します。
+
 ### 方法A: ワンライナーインストール（.NET 不要）
 
 コンテナ、CI、Linux/macOS 環境で .NET SDK なしで使えます。

changelog.d/unreleased/1417.fixed.md

@@ -0,0 +1,17 @@
+---
+category: fixed
+issues:
+  - 1417
+affected:
+  - src/CodeIndex/Mcp/McpServer.cs
+  - src/CodeIndex/Mcp/McpToolHandlers.cs
+  - tests/CodeIndex.Tests/McpServerTests.cs
+---
+
+## English
+
+- **MCP tool argument type mismatches now return JSON-RPC invalid params (#1417)** — wrong JSON types such as a string `limit` now produce `-32602` with structured parameter details instead of falling through to an internal/tool failure.
+
+## 日本語
+
+- **MCP ツール引数の型不一致が JSON-RPC invalid params を返すようになりました (#1417)** — 文字列の `limit` など誤った JSON 型は、internal/tool failure に落ちず `-32602` と構造化されたパラメータ詳細を返します。

changelog.d/unreleased/1438.fixed.md

@@ -0,0 +1,17 @@
+---
+category: fixed
+issues:
+  - 1438
+affected:
+  - src/CodeIndex/Indexer/References/ReferenceExtractor.Preparation.cs
+  - src/CodeIndex/Indexer/References/ReferenceExtractor.TypeReferences.cs
+  - tests/CodeIndex.Tests/ReferenceExtractorTests.cs
+---
+
+## English
+
+- **Python multi-line f-strings no longer emit references from literal text (#1438)** — triple-quoted f-string bodies are masked across physical lines while interpolation expressions still contribute real reference edges.
+
+## 日本語
+
+- **Python の複数行 f-string がリテラル本文から参照を出さなくなりました (#1438)** — 三重引用符の f-string 本文を物理行をまたいでマスクしつつ、補間式内の実参照は引き続き抽出します。

changelog.d/unreleased/1469.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 1469
+affected:
+  - src/CodeIndex/Mcp/McpServer.cs
+  - tests/CodeIndex.Tests/McpServerTests.cs
+---
+
+## English
+
+- **MCP startup logs no longer expose the full DB path by default (#1469)** — the startup banner now logs only a sanitized DB filename unless `CDIDX_DEBUG=unsafe` is set.
+
+## 日本語
+
+- **MCP 起動ログが既定で完全な DB パスを公開しないようになりました (#1469)** — 起動バナーは `CDIDX_DEBUG=unsafe` が設定されていない限り、サニタイズ済みの DB ファイル名だけを記録します。

changelog.d/unreleased/1470.fixed.md

@@ -0,0 +1,16 @@
+---
+category: fixed
+issues:
+  - 1470
+affected:
+  - src/CodeIndex/Mcp/McpServer.cs
+  - tests/CodeIndex.Tests/McpServerTests.cs
+---
+
+## English
+
+- **MCP catch-all error responses now hide exception details by default (#1470)** — unexpected tool and loop failures return generic wire messages while preserving detailed diagnostics in stderr, with verbose responses limited to `CDIDX_DEBUG=unsafe`.
+
+## 日本語
+
+- **MCP catch-all エラー応答が既定で例外詳細を隠すようになりました (#1470)** — 予期しないツール/ループ失敗は wire 上では汎用メッセージを返し、詳細診断は stderr に残します。詳細応答は `CDIDX_DEBUG=unsafe` の場合だけ有効です。

changelog.d/unreleased/1629.fixed.md

@@ -0,0 +1,15 @@
+---
+category: fixed
+issues:
+  - 1629
+affected:
+  - src/CodeIndex/Cli/ConsoleUi.cs
+---
+
+## English
+
+- **Console width detection no longer hides unexpected failures (#1629)** — width probing now catches only documented console exceptions, records fallback use, honors `COLUMNS` after failed probing, and emits a one-time verbose trace.
+
+## 日本語
+
+- **console width 検出が想定外の失敗を隠さないようになりました (#1629)** — 幅取得は既知の console 例外だけを捕捉し、fallback 使用を記録し、失敗時に `COLUMNS` を優先し、verbose で一度だけ trace を出します。

changelog.d/unreleased/1662.fixed.md

@@ -0,0 +1,18 @@
+---
+category: fixed
+issues:
+  - 1662
+affected:
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.FullScan.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.Update.cs
+  - USER_GUIDE.md
+---
+
+## English
+
+- **Human CLI index output now uses invariant numeric formatting (#1662)** — progress and index summaries consistently use culture-independent decimal and thousands separators to match JSON-facing expectations.
+
+## 日本語
+
+- **人間向け CLI index 出力が invariant な数値形式を使うようになりました (#1662)** — progress と index summary は JSON の期待と揃うよう、culture に依存しない小数点と桁区切りを一貫して使います。

changelog.d/unreleased/1835.added.md

@@ -0,0 +1,20 @@
+---
+category: added
+issues:
+  - 1835
+affected:
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.Parse.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.FullScan.cs
+  - src/CodeIndex/Cli/IndexCommandRunner.Update.cs
+  - src/CodeIndex/Cli/CliFlagSchema.cs
+  - USER_GUIDE.md
+---
+
+## English
+
+- **Added long index completion notifications (#1835)** — `cdidx index` now supports `--notify=<auto|bell|osc9|desktop|none>` plus `CDIDX_NOTIFY`, with quiet/json-safe suppression and a five-second threshold for human runs.
+
+## 日本語
+
+- **長い index 完了通知を追加しました (#1835)** — `cdidx index` は `--notify=<auto|bell|osc9|desktop|none>` と `CDIDX_NOTIFY` に対応し、人間向け実行では5秒以上の run だけ通知し、quiet/json では抑制します。