Merge v1.12 track B: codecontext sidecar

# Conflicts:
#	apps/web/src/components/ToolCallLine.tsx
#	docker-compose.yml

docker-compose.yml

@@ -7,6 +7,7 @@ services:
       - "100.114.205.53:9500:3000"
     env_file: .env
     environment:
+      CODECONTEXT_URL: http://codecontext:8080
       CONTAINER_GUIDANCE_FILE: /app/BOOCHAT.md
       DATABASE_URL: postgres://boocode:${POSTGRES_PASSWORD}@boocode_db:5432/boocode
     volumes:
@@ -60,6 +61,33 @@ services:
     networks:
       - boocode_net
 
+  # v1.12 Track B: codecontext sidecar. Stdio MCP server wrapped by a small
+  # HTTP shim (see ./codecontext/). No host port — reached from boocode at
+  # http://codecontext:8080 over the boocode_net bridge.
+  #
+  # Mounts /opt:/opt:ro (not just /opt/projects:ro): BooCode projects live
+  # at /opt/<slug> on the host, not exclusively under /opt/projects. The
+  # mount must cover anywhere a project.path could resolve to. Read-only
+  # because codecontext only analyzes — never writes. The model can't
+  # arbitrarily set target_dir to a sensitive subtree because the B.2
+  # wrappers validate target_dir against project.path before calling the
+  # shim, and the shim isn't reachable from outside boocode_net.
+  codecontext:
+    build:
+      context: ./codecontext
+    container_name: boocode_codecontext
+    restart: unless-stopped
+    networks:
+      - boocode_net
+    volumes:
+      - /opt:/opt:ro
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+
 volumes:
   boocode_pgdata: