feat: add search_code tool wrapping the cs code-search engine

Add a dedicated, permission-gated search_code tool that wraps boyter/cs
(code spelunker) — a fast, relevance-ranked, structure-aware code search
engine — giving agents a better default than grep/find for exploratory
'where is X / how does Y work' searches (ranked results, snippets, ~5x
smaller payloads).

- packages/core/src/tools/search-code.ts: createSearchCodeTool factory;
  -f json invocation, workdir path containment, graceful missing-binary
  handling (DISPATCH_CS_BIN override), readable per-file formatted output.
- Wire-up: export from core; register in agent-manager (both child-whitelist
  and parent perm paths) behind new perm_search_code; add to summon catalog
  + tools enum; frontend ToolPermissions + settings.
- Docker: build a patched, statically-linked cs (pinned v3.1.0 commit) in a
  golang builder stage and bundle at /usr/local/bin/cs.
- docker/cs/luau-declarations.patch: additive Luau declaration table so
  --only-declarations / definition ranking works for Roblox .luau files
  (upstream has Lua but not Luau). Applied during the Docker build.
- Tests: new search-code.test.ts (stubbed JSON formatting + live-cs
  integration, skipped when cs absent); agent-manager/routes mocks +
  perm-gating assertions; loader pass-through.

All tests (596), biome, and tsc (core/api/frontend) pass. cs-builder Docker
stage verified to build and produce a working patched binary.

1 files changed, 19 insertions, 0 deletions

diff --git a/Dockerfile b/Dockerfile
index a5ffeb3..c8511ee 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,22 @@
 # Production Dockerfile — multi-stage build for the API server only
 # Frontend deploys separately (e.g., Cloudflare Pages)
 
+# --- cs (code spelunker) builder ---
+# Builds a patched, statically-linked `cs` binary for the search_code tool.
+# Pinned to the v3.1.0 commit for reproducibility; the patch adds Luau
+# declaration support (see docker/cs/luau-declarations.patch). cs vendors its
+# dependencies, so the `go build` step is offline after the clone.
+FROM golang:1.25-bookworm AS cs-builder
+ARG CS_COMMIT=697e0bf194bbc7a4a877e5170c70618989fc92e7
+WORKDIR /build
+COPY docker/cs/luau-declarations.patch /tmp/luau-declarations.patch
+RUN git clone https://github.com/boyter/cs.git src \
+	&& cd src \
+	&& git checkout "${CS_COMMIT}" \
+	&& git apply /tmp/luau-declarations.patch \
+	&& CGO_ENABLED=0 go build -mod=vendor -ldflags="-s -w" -o /usr/local/bin/cs . \
+	&& /usr/local/bin/cs --version
+
 FROM oven/bun:1 AS builder
 
 WORKDIR /app
@@ -26,6 +42,9 @@ COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/packages/core ./packages/core
 COPY --from=builder /app/packages/api ./packages/api
 
+# Bundle the patched `cs` code-search binary for the search_code tool
+COPY --from=cs-builder /usr/local/bin/cs /usr/local/bin/cs
+
 # Create workspace directory for file tools
 RUN mkdir -p workspace