feat: add HTTP transport mode and server config file support

[PatrickSys]

Summary

• HTTP transport: New --http flag starts an SSE-based MCP server on a configurable port (default 3100), alongside the existing stdio mode. Supports CODEBASE_CONTEXT_PORT env var and ~/.codebase-context/config.json port override. Includes factory and HTTP server modules with proper connection lifecycle management.
• Server config file: ~/.codebase-context/config.json is read on startup to pre-register project roots and per-project excludePatterns — no MCP client connection required. Config roots are additive and survive syncKnownRoots() refreshes from client root changes.
• Reliability fixes: Guards against unhandled rejections and resource leaks in HTTP transport (orphaned connections, stdin/ppid/onclose lifecycle).

Test plan

• pnpm run build exits 0
• pnpm run test — all 323 tests pass, including 11 new tests in tests/server-config.test.ts
• Smoke: start with --http, connect an MCP client to http://localhost:3100/sse, verify tools respond
• Smoke: create ~/.codebase-context/config.json with a project root, start server (stdio or HTTP), verify root is pre-indexed without client sending roots
• Smoke: start with no config file — server starts cleanly with no error
• Smoke: CODEBASE_CONTEXT_PORT=4000 codebase-context --http — server binds to port 4000

[greptile-apps]

Greptile Summary

This PR adds two related capabilities: an SSE-based HTTP transport mode (--http flag) and a ~/.codebase-context/config.json file that pre-registers project roots and per-project exclude patterns without requiring an MCP client connection. The changes are well-structured and largely correct — the configRoots map correctly survives syncKnownRoots() refreshes, port/host resolution priority (CLI > env > config > default) is clear, and error handling throughout is graceful.

Key changes:

• src/server/config.ts (new): Reads and validates ~/.codebase-context/config.json; handles ENOENT silently, validates port, expands ~ paths
• src/index.ts: Adds configRoots module-level map, applyServerConfig() helper, integrates config loading into both main() and startHttp() startup paths, merges extraExcludePatterns into CodebaseIndexer at index time
• src/project-state.ts: Adds extraExcludePatterns?: string[] to ProjectState
• tests/server-config.test.ts (new): 11 tests covering the full behaviour of loadServerConfig()

Issues found:

• A project entry with a missing or non-string root field silently resolves to process.cwd() via path.resolve(''), causing the CWD to be indexed unintentionally — see the comment on src/server/config.ts:57–59.
• Port values above 65535 pass the portNum > 0 guard; minor, but an explicit cap would give a cleaner error.
• loadServerConfig() is called twice in the HTTP startup path (once for config application, once for port/host resolution); no functional impact, but a minor clean-up opportunity.

Confidence Score: 4/5

Safe to merge after addressing the empty-root-resolves-to-CWD bug; all other issues are minor style/quality items.

The core logic is sound — configRoots survive syncs, port priority ordering is correct, error handling is graceful, and test coverage is solid. One concrete P1 bug exists: a config entry without a root field silently registers the process CWD as a project root, which is unintended behaviour a user could easily trigger with a malformed config. Fixing it is a one-liner guard. The remaining comments are non-blocking P2 suggestions.

src/server/config.ts — the missing-root-defaults-to-CWD issue and the unbounded port range check both live here.

Important Files Changed

Filename	Overview
src/server/config.ts	New config loader for ~/.codebase-context/config.json; solid error handling and tilde expansion, but a missing root field silently resolves to CWD via path.resolve(''), and port validation doesn't cap at 65535.
src/index.ts	Integrates config loading into both stdio (main) and HTTP (startHttp) startup paths; configRoots map correctly survives syncKnownRoots() refreshes; extraExcludePatterns are applied at index time; loadServerConfig() is called twice in the HTTP path (minor redundancy).
src/project-state.ts	Minimal, clean addition of optional extraExcludePatterns field to ProjectState with a clear doc comment.
tests/server-config.test.ts	11 well-scoped tests covering ENOENT, malformed JSON, invalid types, tilde/relative path resolution, valid config, and port validation edge cases; no gaps found.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    CLI[CLI startup] --> HTTP{--http flag?}

    HTTP -->|yes| SH[startHttp]
    HTTP -->|no| MAIN[main]

    SH --> LC1[loadServerConfig]
    MAIN --> LC2[loadServerConfig]

    LC1 --> ASC1[applyServerConfig]
    LC2 --> ASC2[applyServerConfig]

    ASC1 --> CR[configRoots map]
    ASC2 --> CR

    ASC1 --> EP[project.extraExcludePatterns]
    ASC2 --> EP

    SH --> PR[Port resolution CLI flag > env var > config > 3100]
    PR --> HS[startHttpServer host:port]

    MAIN --> STDIO[StdioServerTransport]

    SYNC[syncKnownRoots client roots change] --> CHK{configRoot missing from nextRoots?}
    CHK -->|yes| ADD[re-add from configRoots]
    CHK -->|no| KEEP[keep client entry]

    ADD --> KR[knownRoots]
    KEEP --> KR

    EP --> IDX[performIndexingOnce CodebaseIndexer with merged excludePatterns]

Loading

_{Reviews (1): Last reviewed commit: "style: apply prettier formatting" | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a844e53727

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[PatrickSys]

Adversarial review complete on commit 912e6f6.

I found one real correctness bug in the new config parser: malformed projects[] entries without a usable root were resolving to process.cwd(). That is fixed now, along with a regression test. I also tightened server.port validation to reject values above 65535.

I reviewed the existing inline comments, replied to each one, and resolved the threads. I am not merging this PR because GitHub still reports Quality Checks failing on the repo's existing pnpm audit --prod vulnerabilities (2 vulnerabilities found, 1 moderate | 1 high). The PR-specific code paths build, type-check, and the full test suite passes locally, but the PR is still not in a clean mergeable state.