The first proof run failed in both FreeBSD legs at `npm ci`: the UI
dependency tree pulls in onnxruntime-node, which publishes builds for
win32, darwin and linux only, so npm stops with EBADPLATFORM before the
frontend is built. The VM boot, the pkg prepare step, the gmake detection
and the source sync all worked.
The job now builds the headless binary (scripts/build.sh without
--with-ui) and drops node22/npm-node22 from the prepare step. That still
proves the C core builds and starts on FreeBSD; the UI bundle is
platform-independent JavaScript and is built on every other leg. The
aarch64 comment now says what is actually unproven.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Run the FreeBSD workflow on pushes to ci/freebsd-dispatch-workflow only,
so the branch gets one proof run before review: a new workflow can be
dispatched only once it exists on the default branch. This commit is
removed from the branch before the pull request opens; the merged
workflow stays workflow_dispatch only.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Add .github/workflows/freebsd.yml, a standalone workflow triggered only
by workflow_dispatch. It builds the UI-embedded binary inside FreeBSD
15.1 and 14.4 x86_64 VMs (vmactions/freebsd-vm, full-SHA pin to v1.5.9)
with the canonical scripts/build.sh and runs the binary with --version.
It declares read-only permissions, uploads and publishes nothing, is not
part of ci-ok and is not called by release.yml or dry-run.yml, so a
FreeBSD red never gates a pull request or a release.
scripts/env.sh now detects FreeBSD and selects gmake there (BSD make
cannot read the GNU make syntax of Makefile.cbm) and make everywhere
else; the environment summary line reports the choice. scripts/build.sh
runs $MAKE at all three build call sites. macOS, Linux and Windows still
run make, so their builds are unchanged.
Distilled from #1422 by PR9000: the release matrix, the x86_64-host
choice, the aarch64 exclusion, the vmactions VM approach with a SHA pin,
fail-fast: false and the gmake detection all come from that pull
request, which built on the FreeBSD groundwork of #1093, #1423 and #1467.
Co-authored-by: Pedro Ramos <131530838+pr9000@users.noreply.github.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Main already moved upload-sarif to v4.39.1 (#2779). Move init and analyze to
the same commit, 9b3254085494b55a0f7c4c2b3d2d52cc712ce370 (the commit the
v4.39.1 tag points to), so all three CodeQL actions run one version again.
The pin comment follows the form Dependabot wrote for upload-sarif. The
codeql-action Dependabot group added earlier on this branch keeps the three
in lockstep from here on.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Conflict in .github/workflows/scorecard.yml resolved to the main version:
main already pins upload-sarif to 9b3254085494b55a0f7c4c2b3d2d52cc712ce370
(v4.39.1, #2779), which supersedes this branch's v4.39.0 pin.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The V2 compaction hook pushed a plain object into the compaction request's
event.messages. OpenCode's Message is a schema class at v2.2.5, and nobody has
run this path on a real 2.x host. The try/catch only guards the array push,
which cannot throw. If OpenCode rejects the object, that happens inside its own
compaction, out of the plugin's reach, so an untested note could break
compaction for every OpenCode 2 user. Losing the note costs far less.
Remove the V2 compaction registration and the sessionHooksRegistered flag it
needed. The V2 tool hook, proven on OpenCode 2.2.5, stays, and so does the
1.18.x experimental.session.compacting path. OpenCode 2 sessions still get the
session note on the first tool result of a session. A later change can add a
note after compaction together with a real 2.x run.
The replacement test pins that the generated module registers no session hook
and touches neither event.messages, a system property nor an instruction entry.
Refs #2204
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The hosted Ubuntu x64 runners read the archive through
mirror+file:/etc/apt/apt-mirrors.txt. With Acquire::Retries above 0
(including the apt default of 3), a failover from a dead first entry
of that list (connection refused, DNS failure or a stalled host) to
the next entry goes idle: apt-get fetches a few InRelease files from
the second mirror and then waits until the step timeout. With
Acquire::Retries=0 the same failover completes. Seen on noble
(apt 2.8.3) and jammy (apt 2.4.14).
Every apt step this branch hardened now picks the retry count at
runtime, applied to both update and install: 0 when the runner has the
mirror list (moving to the next mirror is the retry), 3 otherwise
(arm64 runners and any host with plain sources keep their retries).
--error-on=any, the http and https timeouts and the step timeouts are
unchanged.
Proof: the step text extracted from the edited _build.yml (update plus
install of zlib1g-dev), run under bash -e in ubuntu:24.04 and
ubuntu:22.04 containers with runner-shaped mirror lists:
- first mirror refused: exit 0 in 8 s / 9 s, every index and deb
fetched from the second mirror
- first mirror stalled (192.0.2.1): exit 0 in 68 s / 69 s, one 30 s
timeout each for update and install, then the second mirror
- healthy first mirror: exit 0 in 7 s / 9 s
- no mirror list, plain sources: the prefix keeps Retries=3, exit 0
in 8 s / 7 s
- every mirror dead: update exits 100 in under 1 s, install skipped
- revert check, the previous step text with a dead first mirror
(refused or stalled): idle with no Packages index at the 180 s cap
on both releases
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
apt-get update exits 0 when index fetches fail: it only prints
"W: Some index files failed to download. They have been ignored, or
old ones used instead." and the job breaks later at install time with
a misleading "Unable to locate package", or installs from stale lists.
Add --error-on=any to every apt-get update this branch hardens, placed
after the -o options as in test-infrastructure/Dockerfile.msan, so the
update step itself fails when an index cannot be fetched.
Proof in ubuntu:24.04 (apt 2.8.3) and ubuntu:22.04 (apt 2.4.14)
containers with a runner-shaped mirror+file:/etc/apt/apt-mirrors.txt
source and the same -o options CI passes:
- every mirror unreachable: exit 100 with the flag (E: lines), exit 0
without it (W: lines, zero Packages lists), on both apt versions
- first mirror refused or stalled (30 s connect timeout) and the real
archive second: the Ign: failover lines do not trip the flag, exit 0
with every index fetched (measured with Acquire::Retries=0)
- the image sources with the flag: exit 0 and no Ign/W/E lines, so the
option is understood by apt 2.4 and 2.8
- green hosted-runner logs (ubuntu-24.04 and ubuntu-22.04 legs) show no
Ign/Err/W/E lines in the update step
With Acquire::Retries=3 a mirror failover leaves apt idle after the
InRelease failover, with or without the flag and also for a plain
apt-get update; that apt behaviour predates this change and is
unchanged by it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Tool.Result allows content: [], and for it the array branch of
appendResult pushed a text part that held only the session note, so the
note became the whole content of the tool result. Add a text part only
when the array already holds a part; an empty array now falls through to
the string output branch, or the result is returned unchanged.
Pin it in a new agent_clients test: the part-adding push sits inside the
non-empty array branch, ahead of the string output fallback, and no
unguarded array branch is left.
Refs #2204
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The OpenCode 2 compaction hook receives the compaction request, whose
messages are the input the summary is built from. Add the post-compaction
session note there as a text message, mirroring the 1.18.x path that
pushes it into output.context. Session instruction entries are rendered
into the system array of every later request, so the note no longer goes
through ctx.session.instructions.entry, and event.system stays untouched.
Registration and the push still fail open.
Pin it in a new agent_clients test: the push sits inside the compaction
registration, carries a user text part, is guarded by an array check, and
the generated module names neither a system property nor an instruction
entry. The #2077 test drops the assertions that pinned the old channel.
Refs #2204
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
On 2026-11-01 two Linux jobs hung in `sudo apt-get update` right after
"Get:5 https://archive.ubuntu.com/ubuntu noble-security InRelease" until
their job limit; the build never started in either:
- PR 2641, test-tsan x86 (run 41251045506, job 124688326533): the
"Install deps (Ubuntu)" step ran 2 h until the 120-minute job limit.
- PR 2395, test-unix gcc x86 (run 41256855177, job 124705168264): the
same step ran 4 h until the 240-minute job limit.
Both logs show the azure mirror ignored after about 15 s, the fallback to
archive.ubuntu.com, and then no output until the cancel. The default apt
http timeout (120 s) did not end the stall.
Rule applied to every workflow step whose run block calls apt:
- A step-level timeout-minutes. 10 for steps that only provision packages
(green runs on 2026-11-01 and the last green dry run: 5 to 76 s); 20 for
the three pr.yml steps that also run scripts/build.sh (green: 246 to
331 s). A stalled mirror now fails the step in minutes instead of
holding the runner until the job limit.
- `-o Acquire::Retries=3 -o Acquire::http::Timeout=30
-o Acquire::https::Timeout=30` on every apt-get update and install,
with the -o options before the subcommand as in
test-infrastructure/Dockerfile.msan.
Nothing else changes: no action, runner, package or step-order changes.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
cs_lookup_method searches the other declarations of a type (same simple
name, same declared namespace: `partial` pieces, reference-assembly
copies) before it walks the base classes. With global-namespace types now
carrying the namespace "", every same-name type declared without a
namespace anywhere in the repository became a twin of every other one.
Across a repository that is a different type per assembly (each test
project has its own Program or Helper), so a member missing on the
receiver bound to an unrelated type ahead of the receiver's own base.
cs_namespace_twins returns no twins for a type in the global namespace.
Test: cs_lsp::cslsp_global_namespace_types_are_not_partial_twins runs the
production Tier-2 C# registry builder over cross-file defs: two unrelated
global Helper types and a base class. RED without the guard:
stop_base=0 stop_unrelated_global_twin=1. GREEN with it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
C# looks a simple type name up namespace by namespace, innermost outward.
At each namespace N it checks the members of N, then the usings of the
namespace declaration enclosing the reference. The global namespace is
the last N, and its declaration is the compilation unit. So a type
declared without a namespace hides a type that only a compilation-unit
`using` imports, while a `using` inside a namespace body still wins over
the global namespace. Step 8b used to rank every using before the global
namespace.
- CBMCSUsing records whether a directive sits inside a namespace body
(in_namespace). cs_collect_imports tracks it per node, including the
compilation-unit siblings after a file-scoped namespace; the cross-file
entry pre-loads the pipeline import list without placement and the AST
walk upgrades it.
- cs_visible_namespaces ranks a simple name as: enclosing namespaces
innermost outward, namespace-body usings, the global namespace "", and
last the compilation-unit usings.
Ranking the global namespace that high also requires that only a type
proven global claims it. The vendored grammar does not parse a
`ref partial struct` with members, and error recovery dissolves the
enclosing namespace, so every type after it in that namespace surfaced
with no namespace. Mapped to "" those types outranked the real, imported
declaration: on dotnet/runtime 5,313 CALLS moved from implementation
files into reference assemblies (System.Runtime.cs, which declares
DefaultInterpolatedStringHandler as a `ref partial struct`).
cs_type_decl_namespace now returns "" only when the compilation unit
parsed without errors and NULL (unknown, invisible to step 8b, as on
main) otherwise; cs_top_level_namespace passes that through.
Tests:
- parallel_csharp_nested_type_and_global_namespace_binding: the
compilation-unit `using` probe now expects the global type (spec), and
a new namespace-body `using` probe expects the imported one. RED with
the previous order: cu_using=0/0.
- parallel_csharp_parse_damaged_namespace_is_not_global (sequential and
parallel). RED without the clean-parse rule: real=0 no_damaged=0 on
both paths.
- cs_lsp::cslsp_decl_namespace_global_needs_clean_parse: extractor
contract ("" for a clean global type, the namespace when found, never
"" after a parse error).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Resolving a qualified type name A.B that no namespace binds now resolves
the qualifier A as a type first (nested types). A using alias whose target
is qualified by the alias itself re-enters that walk through the alias
step without end: `using Loop = Loop.Inner;` resolves Loop to the target
Loop.Inner, whose qualifier is Loop again, and a mutual pair (`using
Ping = Pong.Inner; using Pong = Ping.Inner;`) cycles the same way. Both
are legal C# when namespaces of those names exist, and the walk overflowed
the stack on them.
The walk now carries a depth counter in the per-file context and stops
after CS_QUALIFIER_MAX_DEPTH (8) levels. One level is one type-nesting
step: a namespace-qualified top-level type binds without recursing, so
real nesting stays far below the bound.
Test: cs_lsp::cslsp_cyclic_alias_qualifier_terminates (self and mutual
alias cycles; the file must still resolve Svc.Go). RED without the bound:
AddressSanitizer stack-overflow, exit 134. GREEN with it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Follow-up to #2347 (issue #2120). Step 8b binds same-name TOP-LEVEL types
by declared namespace, but two shapes still fell through to the short-name
fallback, where the prefix score against a path-derived QN is 0 for every
variant and registration order decided:
1. A qualified A.B whose qualifier A is a TYPE, not a namespace:
new Command.Result(...) and new Grain.Handler(dep).Handle(...).
cs_visible_namespaces only tried A as a namespace, and nested types
carry no namespace_qn, so the scan never had a candidate. Resolution
now falls back to resolving the qualifier as a type (recursively, one
segment shorter) and binding the nested member through the registry.
2. A top-level type with no namespace declaration (global namespace):
cs_top_level_namespace returned NULL for it, making it invisible to
step 8b. Top-level C# types now register namespace_qn "" and
cs_visible_namespaces appends the global namespace last.
Test: parallel_csharp_nested_type_and_global_namespace_binding covers a
nested-type constructor and the member call on its result, a chained
constructor receiver, and a same-name type split across the global
namespace and an imported namespace, in the sequential pipeline and in
the parallel pipeline with the production Tier-2 C# registry. Decoys are
registered first. Adapted to current main: the two constructor-edge
checks gate the parallel path only, because the sequential constructor
edge is still drawn by the textual constructor carrier, a layer this
change does not touch.
Distilled from #2401: the net change of commits d11be54f and 613060ea.
The temporary debug prints added in d11be54f and the stale copy of #2347
the branch carried (already on main as 50d19f85) are not taken.
Co-authored-by: Ersin Tarhan <ersintarhan@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
- keep the `server(ctx)` entry that OpenCode 1.18.x dispatches hooks from
- fill `setup(ctx)` with the V2 hook registrations (execute.after,
compaction) and fail open per domain, so one unavailable registration
neither breaks the host nor disables the other
- prefer `content` over `output` in appendResult and return the result
unchanged when no text surface exists, so a tool's own output is never
hidden
- persist the post-compaction note as a keyed session instruction
(`codebase-memory-session-note`) that survives compaction instead of
editing the system prompt; hosts without that channel skip reinjection
- resolve each session's directory with ctx.session.get (cached), because
ctx.location is the plugin instance's location, not the session's
- update the #2089 emission test in place to state the 2.x contract
Fixes#2204
Refs #2077#2089
Signed-off-by: HazielMagallanes <contactame.haziel@gmail.com>
The complexity helpers were inserted between the comment that documents
extract_elixir_func_def and the function itself, so that comment read as
the description of elixir_node_text_is. Move it back above the function it
documents; the comment and signature are again byte-identical to main. No
code change.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Since #2371 the clauses of a multi-clause function fold into one Function
node whose span covers all of them, but only the first clause was measured:
the folded node kept the complexity, cognitive, loop and access metrics and
the line count of that clause while its span grew.
fold_elixir_clause now receives the metrics of each clause it folds and
adds them to the node: cyclomatic, cognitive and loop_count add up,
loop_depth and max_access_depth take the deepest clause, every clause past
the first adds one dispatch decision to cyclomatic, and lines is recomputed
from the folded span. A clause whose walk reports
CBM_WALK_METRIC_UNAVAILABLE makes the folded value unavailable rather than a
partial sum. This is the treatment proposed in the PR description and
agreed in the review thread.
Indexed elixir-lang/elixir (669f8481, 6703 Elixir Function nodes) against
the merge parent: the 2212 folded functions change, the 4491 single-clause
functions keep identical metrics, Functions with complexity above 0 go from
3412 to 4785, and every node now has lines equal to its span (4491 did
before).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
elixir_compute_complexity kept its pending frames in one fixed 4096-entry
array (48 bytes each, 196,608 bytes in a single stack frame) and stopped
pushing children once it was full. Children are pushed last to first, so a
wider body lost its FIRST children and the function reported a lower
complexity with no signal, on exactly the largest functions. Worker threads
do not get the 8 MB main-thread stack, so the array was a risk of its own.
It now uses the walker pattern cbm_compute_complexity has used since #2375:
a 512-frame on-stack first chunk that spills to the heap through
cbm_walk_stack_reserve (memory core, class EXTRACT) and is released with
cbm_walk_stack_release. If the stack cannot grow, every metric reports
CBM_WALK_METRIC_UNAVAILABLE instead of an undercount. This answers items 2
and 3 of the 2026-08-20 review.
The new test builds a 5000-statement body of alternating if and for. The
fixed stack reports complexity 4095 for it instead of 5000.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The 2026-08-20 review asked for the fingerprint to be equal for two
structurally identical functions with different names, since duplicate
detection is what it exists for. tally repeats the body of summarize with
every function and variable name changed, and both must carry the same
MinHash values. The fingerprint hashes normalised leaf token kinds, so names
never enter it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel
dependabot[bot]
HazielMagallanes