Widthdom · Widthdom · Jun 20, 2026 · Jun 20, 2026 · Jun 20, 2026 · Jun 20, 2026
diff --git a/USER_GUIDE.md b/USER_GUIDE.md
diff --git a/changelog.d/unreleased/3680.fixed.md b/changelog.d/unreleased/3680.fixed.md
@@ -0,0 +1,19 @@
+---
+category: fixed
+issues:
+  - 3680
+affected:
+  - src/CodeIndex/Cli/QueryCommandRunner.cs
+  - src/CodeIndex/Cli/CliFlagSchema.cs
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - USER_GUIDE.md
+  - tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs
+---
+
+## English
+
+- **Exact substring searches can now filter both included and excluded match origins (#3680)** — `cdidx search` accepts `--origin` as a short alias for `--match-origin` and adds repeatable `--exclude-origin` filters for origins such as `code`, `comment`, `string_literal`, `regex_literal`, and `help_text`.
+
+## 日本語
+
+- **exact substring 検索で match origin の include / exclude を指定できるようにしました (#3680)** — `cdidx search` は `--match-origin` の短い別名として `--origin` を受け付け、`code`、`comment`、`string_literal`、`regex_literal`、`help_text` などを除外する `--exclude-origin` を繰り返し指定できます。
diff --git a/changelog.d/unreleased/3709.fixed.md b/changelog.d/unreleased/3709.fixed.md
@@ -0,0 +1,18 @@
+---
+category: fixed
+issues:
+  - 3709
+affected:
+  - src/CodeIndex/Cli/SearchAuditRecipes.cs
+  - src/CodeIndex/Cli/QueryCommandRunner.cs
+  - src/CodeIndex/Mcp/McpToolHandlers.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerSearchTests.cs
+---
+
+## English
+
+- **Catch-block audit recipes now filter by structured match origin (#3709)** — `empty-catch-review` and `broad-exception-catch` declare `match_origins: ["code"]`, recipe JSON exposes facet metadata, and CLI/MCP recipe execution drops comment-only catch matches.
+
+## 日本語
+
+- **catch-block 監査 recipe が構造化された match origin で絞り込むようになりました (#3709)** — `empty-catch-review` と `broad-exception-catch` が `match_origins: ["code"]` を宣言し、recipe JSON に facet metadata を出力します。CLI/MCP の recipe 実行では comment-only の catch 一致を除外します。
diff --git a/changelog.d/unreleased/3730.fixed.md b/changelog.d/unreleased/3730.fixed.md
@@ -0,0 +1,26 @@
+---
+category: fixed
+issues:
+  - 3730
+affected:
+  - src/CodeIndex/Database/DbSearchReader.cs
+  - src/CodeIndex/Models/QueryResults.cs
+  - src/CodeIndex/Cli/QueryCommandRunner.cs
+  - src/CodeIndex/Cli/CliFlagSchema.cs
+  - src/CodeIndex/Cli/ConsoleUi.cs
+  - src/CodeIndex/Cli/ProgramRunner.cs
+  - src/CodeIndex/Mcp/McpToolArgumentContracts.cs
+  - src/CodeIndex/Mcp/McpToolDefinitions.cs
+  - src/CodeIndex/Mcp/McpToolHandlers.cs
+  - USER_GUIDE.md
+  - tests/CodeIndex.Tests/QueryCommandRunnerSearchGuardTests.cs
+  - tests/CodeIndex.Tests/ConsoleUiTests.cs
+---
+
+## English
+
+- **Search guards can now run on the same line as the primary match (#3730)** — `cdidx search` and MCP `search` add `--guard-scope same-line` / `guardScope: "same-line"` so require/reject guards use the primary match column ordering, and JSON guard checks/evidence now report `scope`.
+
+## 日本語
+
+- **search guard を primary match と同じ行だけで評価できるようにしました (#3730)** — `cdidx search` と MCP `search` に `--guard-scope same-line` / `guardScope: "same-line"` を追加し、require/reject guard が primary match の列順を使って判定します。JSON の guard checks/evidence には `scope` も出力されます。
diff --git a/changelog.d/unreleased/3746.fixed.md b/changelog.d/unreleased/3746.fixed.md
@@ -0,0 +1,18 @@
+---
+category: fixed
+issues:
+  - 3746
+affected:
+  - src/CodeIndex/Database/DbSearchReader.cs
+  - src/CodeIndex/Models/QueryResults.cs
+  - src/CodeIndex/Cli/SearchSnippetFormatter.cs
+  - tests/CodeIndex.Tests/QueryCommandRunnerSearchGuardTests.cs
+---
+
+## English
+
+- **Guarded search now retains less intermediate state (#3746)** — guard filtering is applied while ranked candidates are read, deduplication state has per-file/file-count budgets, and compact JSON results can include bounded `diagnostics` when guard candidates or dedup state are truncated.
+
+## 日本語
+
+- **guard 付き search が保持する中間状態を減らしました (#3746)** — ranked candidates の読み込み中に guard filtering を適用し、deduplication state に file 数 / file 単位の上限を設けました。guard candidates や dedup state が打ち切られた場合、compact JSON result に bounded な `diagnostics` を出せます。
diff --git a/src/CodeIndex/Cli/CliFlagSchema.cs b/src/CodeIndex/Cli/CliFlagSchema.cs
@@ -314,9 +314,12 @@ private static IReadOnlyList<CliFlag> BuildAll()
             new() { Name = "--reject-before", ValuePlaceholder = "<query>", Description = "Search: reject primary matches with a nearby guard query before them", Commands = Set("search") },
             new() { Name = "--reject-after", ValuePlaceholder = "<query>", Description = "Search: reject primary matches with a nearby guard query after them", Commands = Set("search") },
             new() { Name = "--guard-window", ValuePlaceholder = "<n>", Description = "Search: line window for require/reject guard queries", Commands = Set("search") },
+            new() { Name = "--guard-scope", ValuePlaceholder = "<window|same-line>", Description = "Search: evaluate guard queries in the line window or on the same line as the primary match", Commands = Set("search") },
             new() { Name = "--unique", ValuePlaceholder = "<path|symbol|origin>", Description = "Search: emit unique aggregation rows", Commands = Set("search") },
             new() { Name = "--count-by", ValuePlaceholder = "<path|symbol|origin>", Description = "Search: count matches grouped by path, symbol, or origin", Commands = Set("search") },
+            new() { Name = "--origin", ValuePlaceholder = "<code|comment|string_literal|regex_literal|help_text>", Description = "Search: alias for --match-origin; keep only matches from selected origins", Commands = Set("search") },
             new() { Name = "--match-origin", ValuePlaceholder = "<code|comment|string_literal|regex_literal|help_text>", Description = "Search: keep only matches from selected origins; repeat or comma-separate values", Commands = Set("search") },
+            new() { Name = "--exclude-origin", ValuePlaceholder = "<code|comment|string_literal|regex_literal|help_text>", Description = "Search: drop matches from selected origins; repeat or comma-separate values", Commands = Set("search") },
             new() { Name = "--result-kind", ValuePlaceholder = "<call_site|declaration|identifier|comment|string_literal>", Description = "Search: keep only projected result kinds; repeat or comma-separate values", Commands = Set("search") },
             new() { Name = "--search-fields", ValuePlaceholder = "<path,line,column,symbol,origin,kind,score,snippet>", Description = "Search: project JSON/NDJSON result fields for audit pipelines", Commands = Set("search") },
             new() { Name = "--results-only", Description = "Search: emit result-only NDJSON without stream done records", Commands = Set("search") },

diff --git a/src/CodeIndex/Cli/ConsoleUi.cs b/src/CodeIndex/Cli/ConsoleUi.cs
@@ -88,7 +88,7 @@ private static readonly (string Command, string Usage)[] CommandUsageLines =
         ("index-commits", "cdidx index <projectPath> --commits <commit-ref> [commit-ref ...] [--db <path>] [--verbose] [--dry-run] [--json] [--memory-trace] [--duration-format <auto|seconds|hms>] [--max-file-bytes <bytes>] [--include-symbol-kind <kind>[,<kind>]] [--exclude-symbol-kind <kind>[,<kind>]]"),
         ("index-changed-between", "cdidx index <projectPath> --changed-between <old-ref> <new-ref> [--db <path>] [--verbose] [--dry-run] [--json] [--memory-trace] [--duration-format <auto|seconds|hms>] [--max-file-bytes <bytes>] [--include-symbol-kind <kind>[,<kind>]] [--exclude-symbol-kind <kind>[,<kind>]]"),
         ("index-files", "cdidx index <projectPath> --files <path> [path ...] [--db <path>] [--verbose] [--dry-run] [--json] [--memory-trace] [--duration-format <auto|seconds|hms>] [--max-file-bytes <bytes>] [--include-symbol-kind <kind>[,<kind>]] [--exclude-symbol-kind <kind>[,<kind>]]"),
-        ("search", "cdidx search <query>|--query <query>|-- <query>|--recipe <name|name/query>|--list-recipes|--named-query <name>=<query> [--named-query <name>=<query> ...] [--include-query <name>] [--exclude-query <name>] [--cursor <cursor>] [--audit-scope <source|all>] [--show-excluded] [--db <path>] [--json[=ndjson|array]] [--pretty] [--format <text|json|count|compact|csv|tsv|lsp|qf|sarif|issue-drafts>] [--open-issues <path|github|github:owner/name>] [--repo <owner/name>] [--duplicate-confidence <low|medium|high>|--duplicate-threshold <score>] [--issue-title <title>] [--issue-label <label>] [--verbose] [--limit <n>|--top <n>|--max-results <n>] [--lang <lang>] [--path <glob>] [--exclude-path <glob>] [--exclude-tests] [--exclude-comments] [--exclude-strings] [--exclude-fixtures] [--snippet-lines <n>] [--snippet-focus <leftmost|quality|proximity>] [--max-line-width <n>] [--fts] [--exact|--exact-substring] [--prefix] [--count] [--group-by <file|symbol>] [--since <datetime>] [--no-dedup] [--no-visibility-rank] [--require-before <query>] [--require-after <query>] [--reject-before <query>] [--reject-after <query>] [--guard-window <n>]"),
+        ("search", "cdidx search <query>|--query <query>|-- <query>|--recipe <name|name/query>|--list-recipes|--named-query <name>=<query> [--named-query <name>=<query> ...] [--include-query <name>] [--exclude-query <name>] [--cursor <cursor>] [--audit-scope <source|all>] [--show-excluded] [--db <path>] [--json[=ndjson|array]] [--pretty] [--format <text|json|count|compact|csv|tsv|lsp|qf|sarif|issue-drafts>] [--open-issues <path|github|github:owner/name>] [--repo <owner/name>] [--duplicate-confidence <low|medium|high>|--duplicate-threshold <score>] [--issue-title <title>] [--issue-label <label>] [--verbose] [--limit <n>|--top <n>|--max-results <n>] [--lang <lang>] [--path <glob>] [--exclude-path <glob>] [--exclude-tests] [--exclude-comments] [--exclude-strings] [--exclude-fixtures] [--snippet-lines <n>] [--snippet-focus <leftmost|quality|proximity>] [--max-line-width <n>] [--fts] [--exact|--exact-substring] [--prefix] [--count] [--group-by <file|symbol>] [--since <datetime>] [--no-dedup] [--no-visibility-rank] [--require-before <query>] [--require-after <query>] [--reject-before <query>] [--reject-after <query>] [--guard-window <n>] [--guard-scope <window|same-line>]"),
         ("definition", "cdidx definition <query>|--query <query>|-- <query> [--db <path>] [--json] [--format <text|json|count|compact|csv|tsv|lsp|qf|sarif>] [--verbose] [--limit <n>|--top <n>] [--lang <lang>] [--kind <kind>] [--visibility <v[,v]>] [--exclude-visibility <v[,v]>] [--path <glob>] [--exclude-path <glob>] [--exclude-tests] [--body] [--exact|--exact-name] [--count] [--since <datetime>]"),
         ("goto", "cdidx goto <query>|--query <query>|-- <query> [--db <path>] [--json] [--limit <n>|--top <n>] [--lang <lang>] [--kind <kind>] [--path <glob>] [--exclude-path <glob>] [--exclude-tests] [--exact|--exact-name] [--all]"),
         ("references", "cdidx references <query>|--query <query>|-- <query> [--db <path>] [--json] [--format <text|json|count|compact|csv|tsv|lsp|qf|sarif>] [--verbose] [--limit <n>|--top <n>] [--lang <lang>] [--kind <kind>] [--path <glob>] [--exclude-path <glob>] [--exclude-tests] [--body] [--snippet-lines <n>] [--max-line-width <n>] [--exact|--exact-name] [--count]"),
@@ -1022,6 +1022,8 @@ private static void PrintFlagReference(Action<string> WriteHelpLine)
         Console.WriteLine("  --exclude-comments         search only: suppress comment-only matches");
         Console.WriteLine("  --exclude-strings          search only: suppress string, regex, and help-text matches");
         Console.WriteLine("  --exclude-fixtures         search only: suppress fixture-only matches in tests");
+        WriteHelpLine("  --origin/--match-origin <origin> search only: keep only matches from selected origins (code, comment, string_literal, regex_literal, help_text, unknown; repeatable or comma-separated)");
+        WriteHelpLine("  --exclude-origin <origin>  search only: drop matches from selected origins while keeping other origins in the same result");
         Console.WriteLine("  --include-generated        Include generated files in query results");
         Console.WriteLine("  --snippet-lines <n>        search/find snippet length (1-20, default: search 8; find 1)");
         Console.WriteLine("  --snippet-focus <mode>     search only: long-line focus mode (leftmost|quality|proximity, default: quality)");
@@ -1051,6 +1053,7 @@ private static void PrintFlagReference(Action<string> WriteHelpLine)
         Console.WriteLine("  --no-dedup                 search only: return every raw overlapping chunk hit (debug/density)");
         WriteHelpLine($"  --require-before/--require-after <query>  search only: keep primary matches only when the guard query appears within --guard-window lines before/after the match (default {DbReader.DefaultSearchGuardWindow}, max {DbReader.MaxSearchGuardWindow})");
         WriteHelpLine("  --reject-before/--reject-after <query>    search only: drop primary matches when the guard query appears within the same before/after window; useful for finding API calls missing nearby checks");
+        WriteHelpLine("  --guard-scope <window|same-line> search only: evaluate guards in the line window (default) or only on the same line before/after the primary match");
         WriteHelpLine("  --bytes                    files: sort by size and show raw byte counts in human output; map: show raw byte counts; JSON always keeps raw integer bytes");
         Console.WriteLine("  --min-entrypoint-confidence <n>  map only: omit entrypoint candidates below this 0.0..1.0 confidence");
         WriteHelpLine("  --max-hops <n>             Max BFS hops for impact analysis, inclusive (default: 5; --max-hops 2 returns callers at hop 1 and 2; --max-hops 0 resolves the symbol without traversing callers)");

diff --git a/src/CodeIndex/Cli/ProgramRunner.cs b/src/CodeIndex/Cli/ProgramRunner.cs
@@ -966,6 +966,7 @@ private static bool TryClassifySearchValueTakingOption(string arg, out bool hasI
         "--reject-before",
         "--reject-after",
         "--guard-window",
+        "--guard-scope",
         "--project",
         "--solution",
         "--exclude-path",