The PostToolUse change rendered the manifest twice per install and uninstall
(current and previous generation) and freed both with free(), which grew the
raw allocator count in src/cli/cli.c past its baseline (lint-memory-core).
The manifest is now written with cbm_json_writer_allocator() and released with
cbm_free(CBM_MEM_CLASS_OTHER, ...), including the frees that predate the
change, so cli.c drops from 170 to 166 raw sites and its baseline is lowered
to match. The rendered bytes are unchanged, so byte-exact ownership of
manifests written by earlier installs still holds.
Refs #509
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The Codex CLI row still listed only SessionStart and SubagentStart after the
PreToolUse Bash hook landed (#2719), and the hook section described only
Claude Code's search context. The row now names the Codex search hook, and the
section says how Codex, Copilot CLI and VS Code's Copilot runtime get search
context.
Refs #509
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Copilot CLI's preToolUse output can only decide permissions, and its command
hooks fail closed on errors, so the graph context that Claude Code and Codex
searches get could not ride a pre-tool hook there. postToolUse
additionalContext is appended to the tool result the model sees on the same
turn (github/docs content/copilot/reference/hooks-reference.md). VS Code's
agent mode shares the Copilot harness and reads the same ~/.copilot/hooks
manifest.
- Manifest: $COPILOT_HOME/hooks/codebase-memory-mcp.json adds a PascalCase
PostToolUse entry, matcher "Bash|Grep|Glob|bash|powershell|grep|rg|glob",
running hook-augment --event PostToolUse --dialect copilot. The previous
lifecycle-only manifest, as installs up to v0.12 wrote it, stays recognized
as owned: install upgrades it in place and uninstall removes either
generation. A foreign manifest still fails closed.
- hook-augment: the Copilot dialect reads either payload form
(tool_name/tool_input or toolName/toolArgs), maps runtime tool names to the
Claude names (bash/powershell to Bash, grep/rg to Grep, glob to Glob),
parses arguments passed as a JSON string, and answers with top-level
additionalContext.
- Fast path: Copilot's forced PostToolUse goes through the no-op gate before
executable-identity hashing. The gate also skips tools the augmenter does
not read, because VS Code's local hook parser ignores matchers, so a
non-search shell call or an edit exits in about 20 ms instead of paying the
full round-trip of about 130 ms.
- The context header no longer says the search results are "below": after a
post-tool hook they are above it.
- Tests: the three Copilot foreign-manifest tests now create
.copilot/mcp-config.json. Without it Copilot CLI was never detected, so
install and uninstall never reached the manifest, and the tests also passed
with the ownership checks removed.
Refs #509
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
config_toml_codex_accepts_v0102_managed_windows_crlf asserted that re-upserting
over the v0.10.2 lifecycle-only block left the file byte-identical. That block
is now the previous generation: the upsert accepts it as owned and upgrades it
in place. The test now pins that upgrade (one PreToolUse table, BOM, CRLF and
the surrounding tables kept) and that a second upsert is byte-identical.
Refs #715
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Codex runs its hooks with the same contract as Claude Code: its shell tool is
named Bash, tool_input.command is a string, and PreToolUse hookSpecificOutput
additionalContext reaches the model (openai/codex hooks/src/events/
pre_tool_use.rs, core/src/hook_runtime.rs). Codex only had the SessionStart and
SubagentStart reminders (#330), so its grep and rg calls never got the graph
context Claude Code's searches get (#715).
- config.toml: the managed block adds [[hooks.PreToolUse]] matcher = "Bash"
running the same hook-augment command. The previous block (lifecycle pair
only, as installs up to v0.12 wrote it) stays recognized as owned, so an
upgrade replaces it in place and uninstall removes either generation.
- Inline forms (#1432): Codex's inline rewrite of our PreToolUse is replaced.
A user's own inline hooks.PreToolUse is kept and our block then leaves
PreToolUse out, because TOML cannot hold an inline array and array-of-tables
entries for the same key; install says so instead of failing.
- hooks.json: the Codex-only PreToolUse Bash entry is added and removed next to
the lifecycle pair, touching only the entry whose command is ours.
Codex asks users to re-trust changed hook definitions (/hooks).
Refs #715, #509
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Escape project names before building hand-test patterns, compare transport
identifiers as literal tokens, preserve boundaries when extracting prose
and XML facts, and require canonical containment for smoke static assets.
Add regression coverage for metacharacters, dollar identifiers, markup
joining, traversal, symlinks, and malformed URL encoding.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Match canonical Windows separators across watch ownership and admission,
drain all session watches when auto_watch is disabled, and retain the
resolved doc_candidates choice for later refreshes. Add deterministic
regressions for the five observed failures and an absent-option guard.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Thank you for the Windows path fix and the careful pre-fix investigation. This uses the existing UTF-8 filesystem helpers so valid repository roots and cached graph databases are not mistaken for missing paths.
Contributor history and DCO are preserved.
The #2729 messaging refresh removed the language count from docs/index.html, docs/llms.txt, pkg/npm/README.md, scripts/package-release.sh and server.json, so Step 0w (tests/test_language_count_contract.sh) failed on main for every PR: each of those files was still registered as a surface but stated no count. They leave SURFACES; README.md and the Chocolatey nuspec still carry the count and stay gated. Section 4 still fails if any dropped file states a count again without being registered (checked by re-adding one).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Bring CodeQL back to pull requests as jobs of PR CI itself (needed by
ci-ok, no polling), narrowed to first-party code, while push to main,
the weekly run, the dry run and the release keep the full scan.
- codeql.yml: one leg per language (c-cpp, javascript-typescript,
python, actions), scope in .github/codeql/codeql-config.yml. The full
scan traces the whole build, vendored C included. The PR scan
(light: true) analyses each selected language's whole first-party
scope; c-cpp compiles the third-party objects before tracing
(scripts/build.sh --vendored-only) and then traces the first-party
build plus the vendored files the PR changes (--reuse-vendored
--retrace-from, make -W). Diff-informed analysis (codeql-action
v4.38.1, forced on for PR calls) only restricts reported alerts.
The alert check moves into each leg and reads the analysed ref.
Push and PR runs cancel superseded runs per language; dispatched
runs never cancel. Compiler cache off so every compile is traced.
- pr.yml: a codeql job runs the legs of the selected codeql-* lanes;
ci-ok needs it.
- select-lanes.sh: codeql-cpp/-js/-py/-actions lanes, selected by a
change in their scope (any C/C++ incl. vendored; JS/TS, Python and
workflows inside the config's paths minus paths-ignore) and by every
full run (undeterminable diff, workflows, build, CodeQL machinery).
--codeql-scope LANGUAGE prints a list's in-scope paths.
- codeql-retrace-vendored.sh: the vendored C files a PR changes (empty,
never narrowing, when the diff cannot be determined).
- Makefile.cbm: cbm-third-party builds the vendored prod objects only.
- tests: the gate contract pins the new layout; the selector contract
pins that a C change always selects the C scan, an undeterminable
diff selects every language, and a vendored-only change retraces
exactly the changed vendored files. Selector fixtures, ci-ok's job
map, the replay's codeql-action failures (lane codeql-cpp) and the
interface probes follow.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
CodeQL ran on every pull_request push, and PR CI's security / codeql-gate
job polled up to 150 min for that run before ci-ok could pass. With ~30 PRs
pushed at once, the gate jobs held runners while the CodeQL runs they waited
for queued behind them, and PR CI starved for hours.
- codeql.yml: triggers are push to main, a weekly schedule, workflow_call
and workflow_dispatch; pull_request is gone. The open-alert check moves
here, unchanged and still fail-closed, as the `alerts` job (needs
analyze), so every main push and every weekly run fails while any
code-scanning alert is open. Push runs keep cancel-in-progress; called and
scheduled runs get a group of their own. The analysis key is pinned to the
push configuration so dry-run/release uploads do not open configurations
of their own on main.
- _security.yml: codeql-gate removed; callers grant contents: read only.
- dry-run.yml, release.yml: a `codeql` job calls codeql.yml on the
dispatched commit; release verify needs it and requires success.
- select-lanes.sh, require-all-green.sh: the codeql-gate lane is gone from
the selector universe and from ci-ok's job map; no other lane changes.
- tests: the fail-closed contract follows the check to codeql.yml and now
also pins the triggers, the derived callers' grants and release verify;
lane fixtures drop codeql-gate.
- SECURITY.md, MAINTAINERS.md: say where CodeQL runs now.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
__wrap__aligned_free hands a block mimalloc did not make back to the CRT.
A block from the CRT's _aligned_malloc starts past the CRT's bookkeeping
header, so its matching deallocator is _aligned_free; plain free receives
an interior pointer. This branch routes such blocks to
__real__aligned_free.
The new Windows-only mem test allocates through __real__aligned_malloc
(the CRT's own allocator under --wrap), asserts mimalloc does not own the
block, frees it through the wrapper by name, and checks errno and
HeapValidate on the process heap. Freeing the interior pointer with plain
free is a bad-free report under ASan; on an uninstrumented heap the free
fails with errno set or the process terminates.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Carry the csharp_extension_declaration case from #2218 into the
per-language grammar regression table: the #2071 snippet must yield
NumberExtensions and SumPositive, so a future refresh of
tree-sitter-c-sharp cannot silently drop extension block members
again. The label golden table needs a row for every regression case,
so the matching golden row from #2218 comes with it. The
expression-bodied member is wrapped across two lines.
Co-authored-by: lorenzozanee <wyz0707@proton.me>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings #2231 onto main a2227157. The merge is clean. Since the
branch's base 59a05eb1, main refreshed the vendored tree-sitter-c-sharp
to v0.23.5 (#1748). The refreshed grammar still has no `extension`
production, so an extension block still parses as a
constructor_declaration named `extension` and this recovery is still
needed. The merged tree is main plus exactly this PR's two files
(internal/cbm/extract_defs.c +64, tests/test_extraction.c +39).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Follow-up to the review of #2091, on top of the contributor's change.
The three ts_lsp.c walks (infer_return_type_from_body,
rebuild_signatures_from_ast, convert_signature_type_params) now keep
their first 256 slots on the C stack, as the old fixed arrays did, and
grow on the heap through cbm_walk_stack_reserve / cbm_walk_stack_release
(#2375) instead of cutting TSNodeStack storage from ctx->arena:
- Scratch lifetime: ctx->arena in the per-file pass is the result
arena, kept until the result cache is freed, and the return walk runs
once per untyped top-level function. The heap chunk is now released
when each walk ends.
- No silent drop: when the stack cannot grow, cbm_walk_stack_reserve
logs extract.walk_stack_alloc_failed and the walk stops. The return
walk then answers "unknown"; the signature walks leave the
declarations not yet reached as extract_defs registered them.
- Traversal order: children are filled in cursor order (still one O(N)
pass) and popped last-child first, exactly as main's walks did, so of
several returns the later one is still tried first.
tslsp_return_walk_order_prefers_later_return pins it; it fails under
a first-child-first walk.
The TSNodeStack arena initializer in extract_node_stack.h is no longer
needed and is dropped, so that header is unchanged from main. The two
stack-cap tests now fail instead of passing when their buffer
allocation fails.
Co-authored-by: Joshua Richter <jrichter5781@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch up to date with main a2227157. One conflict, in the
include block of internal/cbm/lsp/ts_lsp.c: main added
"../../../src/foundation/platform.h" where this branch added
"extract_node_stack.h". Resolved by keeping both; the next commit
replaces the second.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Maintainer refresh of #2457 (Haskell infix-form definition names,
#2440) onto main a2227157. The branch point 0f52d30c was 1061 commits
behind main.
No textual conflicts. No semantic conflicts:
- resolve_haskell_func_name is unchanged on main since the branch
point, so the new infix-head branch still sits in front of the
first-child fallback it replaces.
- cbm_func_name_node_text gained an early return for C keywords on
main (44efa628). It applies to C-family languages only; the new
Haskell operator branch is independent of it.
- The new test keeps its place beside haskell_function in the
extraction suite.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
eval_condition_partial (from #2253) answers UNKNOWN for a condition whose
alias is not bound yet, but it only looked at c->variable. A function
condition is filed under its first argument's alias, so in
MATCH (a)-[:CALLS]->(b) WHERE coalesce(a.no_such_prop, b.name) = 'x'
the seed row saw a bound a, read coalesce(NULL, <unbound b>) as a
definite mismatch and pruned every row before CALLS expansion: zero rows,
while the same predicate after WITH returned the right ones.
Check every function argument's alias as well, the way this branch's
original fix did (condition_bindings_available), inside main's
three-valued leaf.
RED before: cypher_exec_where_func_arg_on_unbound_target, row_count 0,
expected 1. GREEN after; cypher suite 237 passed.
Co-authored-by: lorenzozanee <wyz0707@proton.me>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Conflict in tests/test_cypher.c: both sides added WHERE NOT regression
tests right after cypher_exec_where_not. Kept both sets, main's four
#2253 tests first, then this branch's four, with their RUN_TEST lines in
the same order. src/cypher/cypher.c merged cleanly to main's version.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The early WHERE pass in execute_single runs on seed rows where only the
first alias is bound, so a NOT on the target node or the relationship
pruned every row (#2250). This branch fixed that by skipping the early
pass until every alias the WHERE reads was bound.
While it waited for review, #2253 (8ab555ee) landed the same fix on
main as a three-valued early pass: an unbound alias is UNKNOWN, NOT
keeps it UNKNOWN, and only a definite FALSE prunes. This branch's
regression tests pass on main's production code unchanged, so restore
src/cypher/cypher.c to the branch's base and keep the tests; the merge
of main that follows takes main's implementation.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The two regressions sat in tests/repro/repro_issue221.c, which builds only
into the non-gating bug-repro runner, so CI could not stop the fix from
regressing. The Windows-only case also skipped on macOS and Linux, and
scripts/repro.sh reports any skipped case as an incomplete board.
Move both into tests/test_cli.c next to the other cbm_find_cli tests,
unchanged apart from their names: the cli suite runs on every CI leg, and
SKIP_PLATFORM is how that suite already marks Windows-only cases.
tests/repro/repro_issue221.c is back to its content on main.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Since this branch was written, main routes cbm_safe_getenv through a
startup settings resolver before it reads the process environment.
cbm_env_dup, its allocating sibling, read only the process environment, so
after the merge the two helpers could give different answers for the same
name.
Consult the resolver first, exactly as cbm_safe_getenv does: a handled
value is copied through the memory core, and a handled NULL masks the
variable. The resolver serves CBM_* settings today, so PATH lookups behave
as before; this keeps both helpers one view of the environment by
construction.
platform_env_dup_honours_the_settings_resolver pins the three cases:
resolved, masked, and falling through to the process environment.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Resolve the src/foundation/platform.h conflict by keeping both blocks:
main's settings environment resolver declarations and this branch's
cbm_env_dup declaration, which sit next to each other after
cbm_safe_getenv.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The store-switch regression for #1115 was added inside
tool_list_projects_tree_uses_one_stable_header_and_keeps_json_direct
and that test was renamed after it, so the name no longer said what
its seven list_projects shape assertions check.
Restore that test exactly as it is on main and move the switch loop
unchanged into tool_project_discovery_agrees_across_store_switches_issue1115
with its own twelve-project fixture. The new test also checks
list_projects before the switches, so it covers both the first-touch
index_status/query case and the before/after list agreement the issue
asked for.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
safe_stat reports a symlink as CBM_NOT_FOUND by policy, and
walk_dir_process_entry turned any CBM_NOT_FOUND into out->failed when
count_only was set. One symlink anywhere in a tree therefore aborted the
whole count.
cbm_discover_count_bounded is what auto-index admission calls (the MCP
session path and the daemon path), so any repository containing any
symlink could never auto-index: admission logged
reason=unsafe_or_unavailable_path files=-1 and returned. Nothing is unsafe
and the walk is not slow; the count simply refused at the first symlink it
met. Explicit index_repository was unaffected, because count_only is false
there and the same entry is skipped rather than fatal.
A count now skips symlinks and still aborts on an entry it genuinely cannot
observe, which is what the admission guard wants.
Carried from #1803 by Logan G onto current main. #1822 has since given
safe_stat an is_symlink out-param for the ignored-files report, so this
reuses it instead of adding a second is_link parameter; the production
change is the one condition. The regression test
discover_count_bounded_survives_a_symlink is the contributor's, aligned
with the neighbouring symlink tests: a visible SKIP_PLATFORM on Windows
instead of compiling it out, no wall-clock deadline (0 = none), and
th_cleanup of its temp tree.
Co-authored-by: Logan G <logan@gosolto.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The Windows half of ws_approve_sensitive_matches_across_separator_styles
asserted the sensitive-root hint for <cache>/.ssh/cfg/sub without creating
that directory. Containment canonicalizes the candidate, which on Windows
opens it (CreateFileW, OPEN_EXISTING), so a missing descendant was reported
as outside the allowed root and the assertion failed on the Windows shard.
Create it the way its parent is created.
The grant file is now written through cbm_fopen, the wrapper every
repository or user path goes through, in binary mode.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
main landed the same separator-equivalent comparison in 2e6dc087
(ws_prefix_equal), so the conflict in ws_is_ancestor_or_equal resolves to
main's helper; the #1718 comment above the function is kept. The two
test-file conflicts were both sides adding tests at the same place, and
keep both.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Walking top-level arrow components also bound every exported `const`
declaration into the module root scope in pass 1. A root-scope binding
makes the JSX resolver fail closed and the exact same-module call path
skip the name, so a same-file `<Badge />` rendered from a function
component lost its CALLS edge (JSX carriers have no other resolver), and
calls such as `formatLabel()` fell back from lsp_ts_local to same_module.
Walking the arrow bodies does not need that binding, so drop it, and pin
both forms with a test that renders and calls an exported arrow const
from a function component and from an arrow component.
On excalidraw/excalidraw @ e1b7aacb the change keeps every edge it adds
over main (+270 CALLS, 0 removed; 6 more same-file JSX edges than with
the binding) and the 17 lsp_ts_local -> same_module downgrades are gone.
Also joins one declaration line that clang-format reflows.
Refs #2559
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch up to date with main; all six conflicts are keep-both:
- pass_calls.c / pass_parallel.c: drop_plain_call keeps the Go
weak-method and Python import-binding (#2127) clauses from main and
ORs the external-import guard after them, identically on both
resolvers. resolve_single_call takes the signature from main, which
already carries the file imports, so the guard reads that array
instead of a second parameter.
- registry.c, pipeline_internal.h: both sides added declarations and
functions at the same anchor; all are kept.
- tests/test_registry.c, tests/test_pipeline.c: both sides added tests
and RUN_TEST lines at the same anchor; all are kept.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel
