Greptile Summary

This PR delivers two things: (1) workspace-aware multi-project routing in the MCP server so a single server instance can serve multiple repos/monorepos without one config entry per project, and (2) a fix for index pollution caused by flat (non-recursive) exclude globs that allowed nested coverage/, dist/, and worktrees/ directories to leak into search results.

Key changes:

• src/index.ts — major rewrite: session-level active-project tracking, LRU watcher eviction (capped at 5 watchers), three-tier project selector (project > active session project > single known project), selection_required structured errors with availableProjects, project-scoped codebase://context/project/<encoded-path> resource URIs.
• src/project-state.ts — clean factory/registry module (pre-existing or added in an earlier commit; not in the 20-file changed list despite the PR description listing it as new).
• src/utils/project-discovery.ts — new marker-based workspace/monorepo traversal (discoverProjectsWithinRoot, findNearestProjectBoundary, isPathWithin).
• src/core/indexer.ts / src/core/file-watcher.ts — exclude patterns upgraded from coverage/** to **/coverage/** plus new directories (worktrees, .claude, .nx, .turbo, .next, .cache, .planning, target, vendor).
• 4 new test files with good coverage of routing edge cases, exclude patterns, and discovery logic.

Issues found:

• P1 – unguarded JSON.parse in resolveProjectSelector (src/index.ts): error-code routing parses ToolResponse.content[0].text without a try/catch; an empty string (not null/undefined) bypasses the ?? '{}' fallback and throws SyntaxError.
• P1 – empty workspaces.packages array treated as a workspace root (src/utils/project-discovery.ts): isWorkspacePackageJson checks Array.isArray(packages) but not packages.length > 0, inconsistently classifying { workspaces: { packages: [] } } as a workspace root while correctly rejecting { workspaces: [] }. This can cause unnecessary deep directory traversal.
• P2 – buildProjectDescriptor has a hidden side-effect (src/index.ts): calls rememberProjectPath() on every invocation, including error-reporting paths.
• P2 – directory walker follows symlinks (src/utils/project-discovery.ts): symlinked directories are traversed without verifying they stay within the trusted root.
• P2 – uniform description prefix on all tools (src/tools/index.ts): the routing preamble is prepended to every tool's description, which may degrade tool-selection accuracy for AI MCP clients.

Confidence Score: 3/5

• Two P1 correctness bugs should be fixed before merging; the rest is well-structured and well-tested.
• The recursive-exclude fix and the overall routing architecture are solid and backed by a comprehensive new test suite (312 passing tests). However, the unguarded JSON.parse in the error-code routing path can throw an uncaught SyntaxError in a real MCP request handler, and the inconsistent empty-array guard in isWorkspacePackageJson can produce false workspace classifications that affect directory traversal. Both are edge cases but are reachable in production. The remaining P2 items are design concerns that don't affect correctness in the common path.
• src/index.ts (resolveProjectSelector JSON parse + buildProjectDescriptor side-effect) and src/utils/project-discovery.ts (isWorkspacePackageJson empty-packages check + symlink traversal)

Sequence Diagram

sequenceDiagram
    participant Client
    participant Server as MCP Server (index.ts)
    participant Resolver as resolveProjectForTool
    participant Discovery as project-discovery.ts
    participant State as project-state.ts

    Client->>Server: tools/call (search_codebase, args)
    Server->>Resolver: resolveProjectForTool(args)

    alt args.project or args.project_directory provided
        Resolver->>Resolver: resolveExplicitProjectSelection()
        Resolver->>Resolver: resolveProjectSelector(selector)
        alt absolute path or file:// URI
            Resolver->>Discovery: findNearestProjectBoundary(path)
            Discovery-->>Resolver: DiscoveredProjectCandidate
            Resolver->>State: getOrCreateProject(rootPath)
        else relative subproject path
            Resolver->>Resolver: match against listProjectDescriptors()
            Resolver->>Resolver: join with each knownRoot
            Resolver->>Discovery: resolveProjectFromAbsolutePath()
            Discovery-->>Resolver: ProjectState
        end
        Resolver->>Server: setActiveProject(rootPath)
    else no project selector
        alt activeProjectKey is set
            Resolver->>State: getOrCreateProject(activeProject)
        else one project available
            Resolver->>State: getOrCreateProject(singleProject)
            Resolver->>Server: setActiveProject()
        else multiple projects, no active
            Resolver-->>Server: selection_required error
            Server-->>Client: {status:"selection_required", availableProjects:[...]}
        end
    end

    Server->>Server: initProject (ensureIndexed + watcher)
    Server->>Server: dispatchTool(name, args, createToolContext(project))
    Server->>Server: inject {project, index} into JSON response
    Server-->>Client: {status:"success", results:[...], project:{...}}

_{Last reviewed commit: "fix: make indexer ex..."}

Superseded by #67. The recursive exclude patterns fix (d1197a9) is the only delta — will land separately if needed.