feat(explore): find quoted prose in indexed source - #392

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

Summary by CodeRabbit

• New Features
  • codegraph_explore now finds quoted passages of three or more words in indexed source code, including script strings and template text. Matching ignores differences in case and punctuation and does not require re-indexing.
  • Results include matching files and line locations, subject to scan and output limits.
• Documentation
  • Updated the README, changelog, and MCP server guidance with search behavior and scan limits.

Walkthrough

codegraph_explore now scans indexed source files for qualifying quoted query text. Matching files can contribute line anchors and callable or file seeds to exploration results. The scan applies limits for span length, file size, bytes read, elapsed time, and match count.

Changes

Quoted-prose search

Security Blast Radius

• inferred — A caller permitted to use Explore can cause quoted phrases to discover and return matching eligible indexed source within the selected project, including files without symbols. Per-call limits bound work and output, not cumulative project-source disclosure across repeated calls. No write, execution, credential, or infrastructure authority is added by the inspected scan path.

Security Findings and Attack Paths

• observed — Prose-only admission expands Explore reachability, but the base already allowed indexed-file source retrieval without requiring graph nodes through handleFileView. Both paths retain the yaml/properties exclusion. This is counterevidence to treating newly discovered files as newly authorized assets; no authorization bypass was established.

Trust Boundaries and Controls

• observed — The scanner checks the opened descriptor against the canonical project root, rejects traversal and non-regular files, and enforces byte limits. Final rendering separately validates lexical and resolved-path containment before reading current bytes. The scan and rendering reads are therefore not one descriptor-bound snapshot.

Resilience and Maintainability Implications

• observed — Prose-only files use the existing session-emission pipeline: deduplication depends on current-content fingerprints, emitted ranges follow actual rendered sections, and final survivor filtering avoids recording removed sections. Session records remain scoped by project and session and commit after successful dispatch. Concurrent duplicate delivery is pre-existing, not a new prose-specific state transition.
• inferred — A concurrent file mutation can invalidate scan-derived prose coordinates before rendering. The existing index-drift gate can omit stale slices or return bounded current whole-file content, but does not revalidate the phrase against the rendered bytes. This is a consistency limitation; unauthorized disclosure or another material security consequence was not demonstrated.

Hardening Proposals

• proposed — Bind prose anchors to the rendered content using a content fingerprint or phrase revalidation. If concurrent filesystem mutation is within the threat model, consider using the descriptor-verified contained reader for final rendering as well. This would strengthen source identity and containment without implying that an exploit was verified.