Conflict in .github/workflows/scorecard.yml resolved to the main version:
main already pins upload-sarif to 9b3254085494b55a0f7c4c2b3d2d52cc712ce370
(v4.39.1, #2779), which supersedes this branch's v4.39.0 pin.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The V2 compaction hook pushed a plain object into the compaction request's
event.messages. OpenCode's Message is a schema class at v2.2.5, and nobody has
run this path on a real 2.x host. The try/catch only guards the array push,
which cannot throw. If OpenCode rejects the object, that happens inside its own
compaction, out of the plugin's reach, so an untested note could break
compaction for every OpenCode 2 user. Losing the note costs far less.
Remove the V2 compaction registration and the sessionHooksRegistered flag it
needed. The V2 tool hook, proven on OpenCode 2.2.5, stays, and so does the
1.18.x experimental.session.compacting path. OpenCode 2 sessions still get the
session note on the first tool result of a session. A later change can add a
note after compaction together with a real 2.x run.
The replacement test pins that the generated module registers no session hook
and touches neither event.messages, a system property nor an instruction entry.
Refs #2204
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The hosted Ubuntu x64 runners read the archive through
mirror+file:/etc/apt/apt-mirrors.txt. With Acquire::Retries above 0
(including the apt default of 3), a failover from a dead first entry
of that list (connection refused, DNS failure or a stalled host) to
the next entry goes idle: apt-get fetches a few InRelease files from
the second mirror and then waits until the step timeout. With
Acquire::Retries=0 the same failover completes. Seen on noble
(apt 2.8.3) and jammy (apt 2.4.14).
Every apt step this branch hardened now picks the retry count at
runtime, applied to both update and install: 0 when the runner has the
mirror list (moving to the next mirror is the retry), 3 otherwise
(arm64 runners and any host with plain sources keep their retries).
--error-on=any, the http and https timeouts and the step timeouts are
unchanged.
Proof: the step text extracted from the edited _build.yml (update plus
install of zlib1g-dev), run under bash -e in ubuntu:24.04 and
ubuntu:22.04 containers with runner-shaped mirror lists:
- first mirror refused: exit 0 in 8 s / 9 s, every index and deb
fetched from the second mirror
- first mirror stalled (192.0.2.1): exit 0 in 68 s / 69 s, one 30 s
timeout each for update and install, then the second mirror
- healthy first mirror: exit 0 in 7 s / 9 s
- no mirror list, plain sources: the prefix keeps Retries=3, exit 0
in 8 s / 7 s
- every mirror dead: update exits 100 in under 1 s, install skipped
- revert check, the previous step text with a dead first mirror
(refused or stalled): idle with no Packages index at the 180 s cap
on both releases
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
apt-get update exits 0 when index fetches fail: it only prints
"W: Some index files failed to download. They have been ignored, or
old ones used instead." and the job breaks later at install time with
a misleading "Unable to locate package", or installs from stale lists.
Add --error-on=any to every apt-get update this branch hardens, placed
after the -o options as in test-infrastructure/Dockerfile.msan, so the
update step itself fails when an index cannot be fetched.
Proof in ubuntu:24.04 (apt 2.8.3) and ubuntu:22.04 (apt 2.4.14)
containers with a runner-shaped mirror+file:/etc/apt/apt-mirrors.txt
source and the same -o options CI passes:
- every mirror unreachable: exit 100 with the flag (E: lines), exit 0
without it (W: lines, zero Packages lists), on both apt versions
- first mirror refused or stalled (30 s connect timeout) and the real
archive second: the Ign: failover lines do not trip the flag, exit 0
with every index fetched (measured with Acquire::Retries=0)
- the image sources with the flag: exit 0 and no Ign/W/E lines, so the
option is understood by apt 2.4 and 2.8
- green hosted-runner logs (ubuntu-24.04 and ubuntu-22.04 legs) show no
Ign/Err/W/E lines in the update step
With Acquire::Retries=3 a mirror failover leaves apt idle after the
InRelease failover, with or without the flag and also for a plain
apt-get update; that apt behaviour predates this change and is
unchanged by it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Tool.Result allows content: [], and for it the array branch of
appendResult pushed a text part that held only the session note, so the
note became the whole content of the tool result. Add a text part only
when the array already holds a part; an empty array now falls through to
the string output branch, or the result is returned unchanged.
Pin it in a new agent_clients test: the part-adding push sits inside the
non-empty array branch, ahead of the string output fallback, and no
unguarded array branch is left.
Refs #2204
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The OpenCode 2 compaction hook receives the compaction request, whose
messages are the input the summary is built from. Add the post-compaction
session note there as a text message, mirroring the 1.18.x path that
pushes it into output.context. Session instruction entries are rendered
into the system array of every later request, so the note no longer goes
through ctx.session.instructions.entry, and event.system stays untouched.
Registration and the push still fail open.
Pin it in a new agent_clients test: the push sits inside the compaction
registration, carries a user text part, is guarded by an array check, and
the generated module names neither a system property nor an instruction
entry. The #2077 test drops the assertions that pinned the old channel.
Refs #2204
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
On 2026-11-01 two Linux jobs hung in `sudo apt-get update` right after
"Get:5 https://archive.ubuntu.com/ubuntu noble-security InRelease" until
their job limit; the build never started in either:
- PR 2641, test-tsan x86 (run 41251045506, job 124688326533): the
"Install deps (Ubuntu)" step ran 2 h until the 120-minute job limit.
- PR 2395, test-unix gcc x86 (run 41256855177, job 124705168264): the
same step ran 4 h until the 240-minute job limit.
Both logs show the azure mirror ignored after about 15 s, the fallback to
archive.ubuntu.com, and then no output until the cancel. The default apt
http timeout (120 s) did not end the stall.
Rule applied to every workflow step whose run block calls apt:
- A step-level timeout-minutes. 10 for steps that only provision packages
(green runs on 2026-11-01 and the last green dry run: 5 to 76 s); 20 for
the three pr.yml steps that also run scripts/build.sh (green: 246 to
331 s). A stalled mirror now fails the step in minutes instead of
holding the runner until the job limit.
- `-o Acquire::Retries=3 -o Acquire::http::Timeout=30
-o Acquire::https::Timeout=30` on every apt-get update and install,
with the -o options before the subcommand as in
test-infrastructure/Dockerfile.msan.
Nothing else changes: no action, runner, package or step-order changes.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
cs_lookup_method searches the other declarations of a type (same simple
name, same declared namespace: `partial` pieces, reference-assembly
copies) before it walks the base classes. With global-namespace types now
carrying the namespace "", every same-name type declared without a
namespace anywhere in the repository became a twin of every other one.
Across a repository that is a different type per assembly (each test
project has its own Program or Helper), so a member missing on the
receiver bound to an unrelated type ahead of the receiver's own base.
cs_namespace_twins returns no twins for a type in the global namespace.
Test: cs_lsp::cslsp_global_namespace_types_are_not_partial_twins runs the
production Tier-2 C# registry builder over cross-file defs: two unrelated
global Helper types and a base class. RED without the guard:
stop_base=0 stop_unrelated_global_twin=1. GREEN with it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
C# looks a simple type name up namespace by namespace, innermost outward.
At each namespace N it checks the members of N, then the usings of the
namespace declaration enclosing the reference. The global namespace is
the last N, and its declaration is the compilation unit. So a type
declared without a namespace hides a type that only a compilation-unit
`using` imports, while a `using` inside a namespace body still wins over
the global namespace. Step 8b used to rank every using before the global
namespace.
- CBMCSUsing records whether a directive sits inside a namespace body
(in_namespace). cs_collect_imports tracks it per node, including the
compilation-unit siblings after a file-scoped namespace; the cross-file
entry pre-loads the pipeline import list without placement and the AST
walk upgrades it.
- cs_visible_namespaces ranks a simple name as: enclosing namespaces
innermost outward, namespace-body usings, the global namespace "", and
last the compilation-unit usings.
Ranking the global namespace that high also requires that only a type
proven global claims it. The vendored grammar does not parse a
`ref partial struct` with members, and error recovery dissolves the
enclosing namespace, so every type after it in that namespace surfaced
with no namespace. Mapped to "" those types outranked the real, imported
declaration: on dotnet/runtime 5,313 CALLS moved from implementation
files into reference assemblies (System.Runtime.cs, which declares
DefaultInterpolatedStringHandler as a `ref partial struct`).
cs_type_decl_namespace now returns "" only when the compilation unit
parsed without errors and NULL (unknown, invisible to step 8b, as on
main) otherwise; cs_top_level_namespace passes that through.
Tests:
- parallel_csharp_nested_type_and_global_namespace_binding: the
compilation-unit `using` probe now expects the global type (spec), and
a new namespace-body `using` probe expects the imported one. RED with
the previous order: cu_using=0/0.
- parallel_csharp_parse_damaged_namespace_is_not_global (sequential and
parallel). RED without the clean-parse rule: real=0 no_damaged=0 on
both paths.
- cs_lsp::cslsp_decl_namespace_global_needs_clean_parse: extractor
contract ("" for a clean global type, the namespace when found, never
"" after a parse error).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Resolving a qualified type name A.B that no namespace binds now resolves
the qualifier A as a type first (nested types). A using alias whose target
is qualified by the alias itself re-enters that walk through the alias
step without end: `using Loop = Loop.Inner;` resolves Loop to the target
Loop.Inner, whose qualifier is Loop again, and a mutual pair (`using
Ping = Pong.Inner; using Pong = Ping.Inner;`) cycles the same way. Both
are legal C# when namespaces of those names exist, and the walk overflowed
the stack on them.
The walk now carries a depth counter in the per-file context and stops
after CS_QUALIFIER_MAX_DEPTH (8) levels. One level is one type-nesting
step: a namespace-qualified top-level type binds without recursing, so
real nesting stays far below the bound.
Test: cs_lsp::cslsp_cyclic_alias_qualifier_terminates (self and mutual
alias cycles; the file must still resolve Svc.Go). RED without the bound:
AddressSanitizer stack-overflow, exit 134. GREEN with it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Follow-up to #2347 (issue #2120). Step 8b binds same-name TOP-LEVEL types
by declared namespace, but two shapes still fell through to the short-name
fallback, where the prefix score against a path-derived QN is 0 for every
variant and registration order decided:
1. A qualified A.B whose qualifier A is a TYPE, not a namespace:
new Command.Result(...) and new Grain.Handler(dep).Handle(...).
cs_visible_namespaces only tried A as a namespace, and nested types
carry no namespace_qn, so the scan never had a candidate. Resolution
now falls back to resolving the qualifier as a type (recursively, one
segment shorter) and binding the nested member through the registry.
2. A top-level type with no namespace declaration (global namespace):
cs_top_level_namespace returned NULL for it, making it invisible to
step 8b. Top-level C# types now register namespace_qn "" and
cs_visible_namespaces appends the global namespace last.
Test: parallel_csharp_nested_type_and_global_namespace_binding covers a
nested-type constructor and the member call on its result, a chained
constructor receiver, and a same-name type split across the global
namespace and an imported namespace, in the sequential pipeline and in
the parallel pipeline with the production Tier-2 C# registry. Decoys are
registered first. Adapted to current main: the two constructor-edge
checks gate the parallel path only, because the sequential constructor
edge is still drawn by the textual constructor carrier, a layer this
change does not touch.
Distilled from #2401: the net change of commits d11be54f and 613060ea.
The temporary debug prints added in d11be54f and the stale copy of #2347
the branch carried (already on main as 50d19f85) are not taken.
Co-authored-by: Ersin Tarhan <ersintarhan@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
- keep the `server(ctx)` entry that OpenCode 1.18.x dispatches hooks from
- fill `setup(ctx)` with the V2 hook registrations (execute.after,
compaction) and fail open per domain, so one unavailable registration
neither breaks the host nor disables the other
- prefer `content` over `output` in appendResult and return the result
unchanged when no text surface exists, so a tool's own output is never
hidden
- persist the post-compaction note as a keyed session instruction
(`codebase-memory-session-note`) that survives compaction instead of
editing the system prompt; hosts without that channel skip reinjection
- resolve each session's directory with ctx.session.get (cached), because
ctx.location is the plugin instance's location, not the session's
- update the #2089 emission test in place to state the 2.x contract
Fixes#2204
Refs #2077#2089
Signed-off-by: HazielMagallanes <contactame.haziel@gmail.com>
The complexity helpers were inserted between the comment that documents
extract_elixir_func_def and the function itself, so that comment read as
the description of elixir_node_text_is. Move it back above the function it
documents; the comment and signature are again byte-identical to main. No
code change.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Since #2371 the clauses of a multi-clause function fold into one Function
node whose span covers all of them, but only the first clause was measured:
the folded node kept the complexity, cognitive, loop and access metrics and
the line count of that clause while its span grew.
fold_elixir_clause now receives the metrics of each clause it folds and
adds them to the node: cyclomatic, cognitive and loop_count add up,
loop_depth and max_access_depth take the deepest clause, every clause past
the first adds one dispatch decision to cyclomatic, and lines is recomputed
from the folded span. A clause whose walk reports
CBM_WALK_METRIC_UNAVAILABLE makes the folded value unavailable rather than a
partial sum. This is the treatment proposed in the PR description and
agreed in the review thread.
Indexed elixir-lang/elixir (669f8481, 6703 Elixir Function nodes) against
the merge parent: the 2212 folded functions change, the 4491 single-clause
functions keep identical metrics, Functions with complexity above 0 go from
3412 to 4785, and every node now has lines equal to its span (4491 did
before).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
elixir_compute_complexity kept its pending frames in one fixed 4096-entry
array (48 bytes each, 196,608 bytes in a single stack frame) and stopped
pushing children once it was full. Children are pushed last to first, so a
wider body lost its FIRST children and the function reported a lower
complexity with no signal, on exactly the largest functions. Worker threads
do not get the 8 MB main-thread stack, so the array was a risk of its own.
It now uses the walker pattern cbm_compute_complexity has used since #2375:
a 512-frame on-stack first chunk that spills to the heap through
cbm_walk_stack_reserve (memory core, class EXTRACT) and is released with
cbm_walk_stack_release. If the stack cannot grow, every metric reports
CBM_WALK_METRIC_UNAVAILABLE instead of an undercount. This answers items 2
and 3 of the 2026-08-20 review.
The new test builds a 5000-statement body of alternating if and for. The
fixed stack reports complexity 4095 for it instead of 5000.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The 2026-08-20 review asked for the fingerprint to be equal for two
structurally identical functions with different names, since duplicate
detection is what it exists for. tally repeats the body of summarize with
every function and variable name changed, and both must carry the same
MinHash values. The fingerprint hashes normalised leaf token kinds, so names
never enter it.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The carried #1731 test asserted complexity and line counts but never the fingerprint, which is half of what the change adds. A body past the MinHash size gate must now carry one, and a one-expression body must not. Raised in the 2026-08-20 review.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
clang-format the new snprintf in detect_url_in_args (the line ran past
100 columns, the CI lint failure) and raise eprops to 1K: two escaped
255-byte strings plus the keys and the verb no longer fit in 512.
Add a parallel-route test with wrapper calls that actually reach the
arg-URL heuristic: a project wrapper whose verb is not a route suffix
(this.api.head / this.api.options, URL first) and a route-verb wrapper
whose URL sits in a keyword the registration reader does not take as a
path (self.session.get(resource=...)). Each gets one HTTP_CALLS edge typed
with its verb and no ANY twin. The sequential resolver has no arg-URL
heuristic (#2848), so the test is parallel only.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
All three seeded client edges carried "GET", so match_http_routes never
entered its callee-verb fallback. getItem and getJob are now stored
without a method, as an index that did not record the verb writes them.
Without the fallback the method-less fuzzy match lands on the DELETE and
POST routes seeded first; with it both reach their GET handlers. getItems
keeps its explicit GET.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
calls_emit_unresolved_service order: resolve_single_call already emits
every callee-matched HTTP/ASYNC call with a URL argument before it reaches
the empty-resolution fallback, and the global fetch has no route suffix,
so the order inside the fallback never decides an edge.
route_edge_visitor method fallback: every HTTP_CALLS emitter writes
"method" exactly when cbm_service_pattern_http_method(callee) finds a verb,
so recomputing it from the stored callee always yields NULL there.
Both files return to their main versions.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The new HttpClient receiver rows matched by prefix, and an uppercase
letter after an id counts as CamelCase glue, so "this.http" also matched
this.httpAdapter.get (a NestJS route registration) and this.httpServer.post,
and "$http" matched $httpBackend.expectGET (an AngularJS test double).
Each receiver row now ends in a dot, like "gin.", plus a line-break twin
(LF, and CR for CRLF files): a chain wrapped before the verb keeps the break
in its callee text ("this.http\n .post"). On
gothinkster/angular-realworld-example-app 5 of the 18 client calls are
written that way; with dot-only rows they fell back to phantom route
registrations. "HttpClient" duplicated the Java/C# row and
"this.httpClient." is covered by "httpClient.".
Unit cases pin both directions, and the Angular pipeline test gains a
wrapped call on both resolver routes.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch up to f6fb3e0d, which carries #2371 (guarded def heads,
the multi-clause fold and typespec attributes) and #1730.
Two files conflicted, both at spots where main rewrote the Elixir
definition code. Each is rebuilt as the main version of the file plus the
lines this branch adds, at the same place; no conflict side is
concatenated:
- internal/cbm/extract_defs.c: the complexity helpers sit between the
definition comment and extract_elixir_func_def as before, and the
metrics plus fingerprint block follows def.is_exported in the unfolded
path.
- tests/test_extraction.c: TEST(elixir_complexity_and_fingerprint) and
its RUN_TEST go just before the Haskell block, after the Elixir tests
main added.
Per-file patch-id (git diff -U0 | git patch-id --stable) of this merge
against origin/main equals the branch change against its old base:
extract_defs.c b591a7bc, test_extraction.c 7b507156. The merge removes no
line of either file.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Three small items promised in the #2315 review; behaviour is otherwise
unchanged.
1. A failed ADR restore on artifact import is no longer silent
(src/pipeline/artifact.c). The import dropped both a failed reopen of
the installed DB and the status of
cbm_store_adr_restore_from_graph_if_absent, so a team ADR that never
reached the sidecar left no trace. The restore moves into
artifact_import_restore_adr, which logs
level=warn msg=artifact.import err=adr_restore detail=<store error>
path=<db> on either failure. The import still returns 0: the graph DB
is already installed when the restore runs, and the restore stays
best-effort as documented. adr_restore_if_absent now sets the store
error for its begin, copy and commit failures, so the logged detail
names the failing step.
2. The doc comment of adr_copy_legacy_once sat above adr_copy_rows,
stacked on top of the comment that documents adr_copy_rows, which left
adr_copy_legacy_once undocumented. It now sits above
adr_copy_legacy_once (src/store/store.c).
3. adr_restore_if_absent no longer inserts the migrated marker. That
INSERT OR IGNORE could never change state. Its only caller,
cbm_store_adr_restore_from_graph_if_absent, takes the sidecar handle
from adr_conn_write, which hands out a handle (cached or fresh) only
after adr_copy_legacy_once returned OK, and that function returns OK
only when the marker row is already committed (fast path, or the
re-check under the write lock) or it just inserted and committed it.
No code deletes an adr_meta row, so the insert hit the existing
primary key every time, and its result was discarded anyway.
Tests: artifact_import_logs_failed_adr_restore puts a directory at
<db>.adr.db (the hook-free trick from the #2315 pipeline test), then
asserts the import still succeeds, the graph DB is installed, and the
warn line carries the store reason. It is red without the artifact.c
change. artifact_export_roundtrip_keeps_adr now also asserts that the
fresh destination sidecar is marked migrated after the import, which
pins the invariant item 3 relies on.
Refs #2315
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel
HazielMagallanes