feat(cross-repo): unified cross-repository index, search, and channel flow tracing

Adds cross-repo capabilities to CBM by building a unified _cross_repo.db
that aggregates node stubs, channels, and embeddings from all per-project
databases. This bridges the per-project isolation gap without compromising
the security model (no ATTACH DATABASE — data is copied, not linked).

New files:
- src/store/cross_repo.h — API: build, search, channel matching, stats
- src/store/cross_repo.c — Implementation (~550 lines)
  - cbm_cross_repo_build(): scans all project DBs, copies nodes (134K),
    channels (526), embeddings (134K) into _cross_repo.db. Build time: ~2s.
  - cbm_cross_repo_search(): BM25 FTS5 + vector search + RRF merge across
    all repos in a single query. CamelCase token splitting enabled.
  - cbm_cross_repo_match_channels(): finds emit/listen pairs across repos
    (12 unique cross-repo channels detected, 127 individual flow matches)
  - cbm_cross_repo_get_info(): stats about the cross-repo index

New MCP tools:
- build_cross_repo_index: manually trigger cross-repo index rebuild
- trace_cross_repo: trace message channels across repositories, showing
  which services produce and consume each channel with file+function detail

Pipeline integration:
- Auto-rebuilds _cross_repo.db after every index_repository (adds ~2s)
- Cross-repo DB is always fresh without manual intervention

Cross-repo channel matching detects:
- Socket.IO channels emitted in one service and listened in another
- EventEmitter patterns across repos
- File-level and function-level attribution for each endpoint

Performance: 54 repos, 134K nodes, 134K embeddings copied in 2.1 seconds.
No new dependencies — uses existing SQLite3 and custom functions.

Author: Your Name

Makefile.cbm

@@ -139,7 +139,7 @@ PREPROCESSOR_SRC = $(CBM_DIR)/preprocessor.cpp
 SQLITE_WRITER_SRC = $(CBM_DIR)/sqlite_writer.c
 
 # Store module (new)
-STORE_SRCS = src/store/store.c
+STORE_SRCS = src/store/store.c src/store/cross_repo.c
 
 # Cypher module (new)
 CYPHER_SRCS = src/cypher/cypher.c

src/mcp/mcp.c

@@ -13,6 +13,7 @@
 #include "cypher/cypher.h"
 #include "pipeline/pipeline.h"
 #include "pipeline/embedding.h"
+#include "store/cross_repo.h"
 #include "cli/cli.h"
 #include "watcher/watcher.h"
 #include "foundation/mem.h"
@@ -380,6 +381,23 @@ static const tool_def_t TOOLS[] = {
      "{\"type\":\"object\",\"properties\":{\"project\":{\"type\":\"string\"},"
      "\"force\":{\"type\":\"boolean\",\"default\":false,\"description\":"
      "\"Re-generate all embeddings even if they already exist\"}},\"required\":[\"project\"]}"},
+
+    {"build_cross_repo_index",
+     "Build unified cross-repo index for cross-repository search, channel matching, and flow tracing. "
+     "Scans all indexed project databases and builds a _cross_repo.db with node stubs, channels, "
+     "and embeddings from all repos. Enables search_graph with project='*' for cross-repo search, "
+     "and trace_cross_repo for cross-service message flow tracing. Auto-rebuilds after each "
+     "index_repository call, but can be triggered manually to refresh.",
+     "{\"type\":\"object\",\"properties\":{}}"},
+
+    {"trace_cross_repo",
+     "Trace message/event channels across repositories. Shows which services produce and consume "
+     "a specific channel, with file-level and function-level detail. Requires build_cross_repo_index "
+     "to have been run at least once.",
+     "{\"type\":\"object\",\"properties\":{"
+     "\"channel\":{\"type\":\"string\",\"description\":\"Channel name to trace (partial match). "
+     "Omit to list all cross-repo channels.\"},"
+     "\"repo\":{\"type\":\"string\",\"description\":\"Filter to channels involving a specific repo.\"}}}"},
 };
 
 static const int TOOL_COUNT = sizeof(TOOLS) / sizeof(TOOLS[0]);
@@ -3870,6 +3888,102 @@ static char *handle_generate_embeddings(cbm_mcp_server_t *srv, const char *args)
     return result;
 }
 
+/* ── build_cross_repo_index ──────────────────────────────────── */
+
+static char *handle_build_cross_repo_index(cbm_mcp_server_t *srv, const char *args) {
+    (void)srv; (void)args;
+
+    cbm_cross_repo_stats_t stats = cbm_cross_repo_build();
+
+    yyjson_mut_doc *doc = yyjson_mut_doc_new(NULL);
+    yyjson_mut_val *root = yyjson_mut_obj(doc);
+    yyjson_mut_doc_set_root(doc, root);
+
+    yyjson_mut_obj_add_str(doc, root, "status",
+                           stats.repos_scanned >= 0 ? "success" : "error");
+    yyjson_mut_obj_add_int(doc, root, "repos_scanned", stats.repos_scanned);
+    yyjson_mut_obj_add_int(doc, root, "nodes_copied", stats.nodes_copied);
+    yyjson_mut_obj_add_int(doc, root, "channels_copied", stats.channels_copied);
+    yyjson_mut_obj_add_int(doc, root, "embeddings_copied", stats.embeddings_copied);
+    yyjson_mut_obj_add_int(doc, root, "cross_repo_channel_matches", stats.cross_repo_matches);
+    yyjson_mut_obj_add_real(doc, root, "build_time_ms", stats.build_time_ms);
+
+    char *json = yy_doc_to_str(doc);
+    yyjson_mut_doc_free(doc);
+
+    char *result = cbm_mcp_text_result(json, stats.repos_scanned < 0);
+    free(json);
+    return result;
+}
+
+/* ── trace_cross_repo ────────────────────────────────────────── */
+
+static char *handle_trace_cross_repo(cbm_mcp_server_t *srv, const char *args) {
+    (void)srv;
+    char *channel = cbm_mcp_get_string_arg(args, "channel");
+
+    cbm_cross_repo_t *cr = cbm_cross_repo_open();
+    if (!cr) {
+        free(channel);
+        return cbm_mcp_text_result(
+            "{\"error\":\"Cross-repo index not built. Run build_cross_repo_index first.\"}", true);
+    }
+
+    /* Get cross-repo info */
+    cbm_cross_repo_info_t info = {0};
+    cbm_cross_repo_get_info(cr, &info);
+
+    /* Get channel matches */
+    cbm_cross_channel_match_t *matches = NULL;
+    int match_count = 0;
+    cbm_cross_repo_match_channels(cr, channel, &matches, &match_count);
+
+    yyjson_mut_doc *doc = yyjson_mut_doc_new(NULL);
+    yyjson_mut_val *root = yyjson_mut_obj(doc);
+    yyjson_mut_doc_set_root(doc, root);
+
+    yyjson_mut_obj_add_int(doc, root, "total_repos", info.total_repos);
+    yyjson_mut_obj_add_int(doc, root, "total_cross_repo_channels", info.cross_repo_channel_count);
+    yyjson_mut_obj_add_int(doc, root, "matches", match_count);
+    if (info.built_at)
+        yyjson_mut_obj_add_strcpy(doc, root, "built_at", info.built_at);
+
+    yyjson_mut_val *arr = yyjson_mut_arr(doc);
+    for (int i = 0; i < match_count; i++) {
+        cbm_cross_channel_match_t *m = &matches[i];
+        yyjson_mut_val *item = yyjson_mut_obj(doc);
+        yyjson_mut_obj_add_strcpy(doc, item, "channel", m->channel_name ? m->channel_name : "");
+        yyjson_mut_obj_add_strcpy(doc, item, "transport", m->transport ? m->transport : "");
+
+        yyjson_mut_val *emit = yyjson_mut_obj(doc);
+        yyjson_mut_obj_add_strcpy(doc, emit, "project", m->emit_project ? m->emit_project : "");
+        yyjson_mut_obj_add_strcpy(doc, emit, "file", m->emit_file ? m->emit_file : "");
+        yyjson_mut_obj_add_strcpy(doc, emit, "function", m->emit_function ? m->emit_function : "");
+        yyjson_mut_obj_add_val(doc, item, "emitter", emit);
+
+        yyjson_mut_val *listen = yyjson_mut_obj(doc);
+        yyjson_mut_obj_add_strcpy(doc, listen, "project", m->listen_project ? m->listen_project : "");
+        yyjson_mut_obj_add_strcpy(doc, listen, "file", m->listen_file ? m->listen_file : "");
+        yyjson_mut_obj_add_strcpy(doc, listen, "function", m->listen_function ? m->listen_function : "");
+        yyjson_mut_obj_add_val(doc, item, "listener", listen);
+
+        yyjson_mut_arr_add_val(arr, item);
+    }
+    yyjson_mut_obj_add_val(doc, root, "channel_flows", arr);
+
+    char *json = yy_doc_to_str(doc);
+    yyjson_mut_doc_free(doc);
+
+    cbm_cross_channel_free(matches, match_count);
+    cbm_cross_repo_info_free(&info);
+    cbm_cross_repo_close(cr);
+    free(channel);
+
+    char *result = cbm_mcp_text_result(json, false);
+    free(json);
+    return result;
+}
+
 /* ── Tool dispatch ────────────────────────────────────────────── */
 
 // NOLINTNEXTLINE(bugprone-easily-swappable-parameters)
@@ -3937,6 +4051,12 @@ char *cbm_mcp_handle_tool(cbm_mcp_server_t *srv, const char *tool_name, const ch
     if (strcmp(tool_name, "generate_embeddings") == 0) {
         return handle_generate_embeddings(srv, args_json);
     }
+    if (strcmp(tool_name, "build_cross_repo_index") == 0) {
+        return handle_build_cross_repo_index(srv, args_json);
+    }
+    if (strcmp(tool_name, "trace_cross_repo") == 0) {
+        return handle_trace_cross_repo(srv, args_json);
+    }
     char msg[256];
     snprintf(msg, sizeof(msg), "unknown tool: %s", tool_name);
     return cbm_mcp_text_result(msg, true);

src/pipeline/pipeline.c

@@ -14,6 +14,7 @@
 #include "pipeline/pipeline_internal.h"
 #include "pipeline/worker_pool.h"
 #include "pipeline/embedding.h"
+#include "store/cross_repo.h"
 #include "graph_buffer/graph_buffer.h"
 #include "store/store.h"
 #include "discover/discover.h"
@@ -881,6 +882,16 @@ int cbm_pipeline_run(cbm_pipeline_t *p) {
                  itoa_buf(cbm_gbuf_edge_count(p->gbuf)), "elapsed_ms",
                  itoa_buf((int)elapsed_ms(t0)));
 
+    /* ── Auto-rebuild cross-repo index after indexing ── */
+    {
+        cbm_cross_repo_stats_t cr_stats = cbm_cross_repo_build();
+        if (cr_stats.repos_scanned > 0) {
+            cbm_log_info("pass.done", "pass", "cross_repo_index",
+                         "repos", itoa_buf(cr_stats.repos_scanned),
+                         "cross_channels", itoa_buf(cr_stats.cross_repo_matches));
+        }
+    }
+
 cleanup:
     /* Free prescan if not already freed */
     if (ctx.prescan_cache) {