Some MCP clients (OpenCode, some VS Code extensions) use LSP-style
Content-Length framing instead of bare JSONL:
Content-Length: 123\r\n\r\n{"jsonrpc":"2.0",...}
The server now auto-detects the transport: if a line starts with
"Content-Length:", it reads the header, skips the blank separator,
reads the exact payload, and responds with Content-Length framing.
Regular JSONL clients are unaffected — the detection only triggers
on the Content-Length prefix.
Fixes#78.
Minified JS in dist/ contains hundreds of string-constant URLs from
bundled npm libraries (React error pages, W3C namespace URIs, CDN
references, OSS credits) that are never fetched at runtime. Scanning
them produced an endless stream of false positives requiring per-URL
allowlisting.
Fix: split the A1 URL check by directory:
- src/ (our code): strict — any external URL is blocked
- dist/ (npm build output): skip inline URL scan entirely
Structural checks (A2-A6) still apply to dist/:
- External <script>/<link> loads in HTML
- Tracking/analytics identifiers
- Iframes, eval/Function, external WebSockets
- Bulk test: use cbm_tmpdir() instead of hardcoded /tmp/ (fixes
Windows/MSYS2 where /tmp/ doesn't resolve for SQLite)
- Install: write MCP config to both ~/.claude/.mcp.json (Claude Code
<=2.1.x) and ~/.claude.json (Claude Code >=2.1.80). Fixes#69.
- Uninstall: remove from both locations
- CONTRIBUTING.md: rewrite for pure C project (was still describing Go,
causing contributors to submit Go PRs)
- Fix clang-format in mcp.c protocol version negotiation (PR #79 merge)
- Fix formatting in mcp.c protocol version negotiation (from PR #79 merge)
- Rewrite CONTRIBUTING.md for pure C project (was still describing Go,
causing contributors to submit Go PRs that can't be merged)
- FastAPI Depends(func_ref): scans Python function signatures for
Depends() patterns and creates CALLS edges to the dependency function.
Without this, auth/DI functions appear as dead code (in_degree=0).
- DLL resolve: scans C/C++ source for GetProcAddress/dlsym/Resolve
patterns and creates CALLS edges to synthetic stub nodes, enabling
call graph tracking across DLL boundaries.
- Extension scoping (#28) was already ported in 6a2b1f5.
- SQL size guard (#62) not needed: our C workers use 8MB stacks.
Tests: 3 new (httplink_laravel_path_filter, pipeline_fastapi_depends_edges,
pipeline_dll_resolve_edges). Total: 2041.
Co-Authored-By: kingchenc <kingchenc@users.noreply.github.com>
Co-Authored-By: mariomeyer <mariomeyer@users.noreply.github.com>
- UI audit (L6): allowlist bundled framework URLs in dist/ (React error
URLs, W3C namespace URIs, Three.js credits, Google Fonts, Tailwind).
These are embedded by npm deps during Vite build, not our code.
- Binary strings (L2): skip URLs shorter than 15 chars — Windows binary
has byte sequences that strings(1) interprets as "https://H9" etc.
- Allow Google Fonts <link> in HTML (loaded by index.html for Inter/
JetBrains Mono fonts).
Port of community fix (PR #65):
- Scope source-based route extractors by file extension: Go routes
only on .go, Express on .js/.ts, Laravel on .php, Ktor on .kt/.kts.
Prevents cross-framework false positives (e.g. Ktor regex matching
PHP Cache::get calls).
- Filter Laravel route paths containing $ or : characters — these are
cache keys or interpolated expressions, not URL paths. Laravel route
parameters use {param} syntax, so valid routes are unaffected.
Co-Authored-By: mariomeyer <mariomeyer@users.noreply.github.com>
Was accidentally committed with a hardcoded absolute path.
The install command generates per-user MCP configs in the
correct editor-specific locations. Added to .gitignore.
Support protocol versions 2025-11-25, 2025-06-18, 2025-03-26, and
2024-11-05. The server now reads the client's requested version and
echoes it if supported, falling back to its latest otherwise. This
fixes the "unsupported protocol" warning in VS Code 1.112+ while
remaining backward-compatible with older clients.
Swift tree-sitter grammar uses positional children (not named fields) for
call_expression, so extract_callee_name() returned NULL for every call.
- extract_calls.c: Swift-specific callee extraction via first named child
for call_expression and constructor_expression nodes
- lang_specs.c: add constructor_expression to swift_call_types
- 4 new C tests: simple calls, method calls, constructors, chained calls
Co-Authored-By: Jay Sync <63868998+jay-sync@users.noreply.github.com>
The install command detected many editors (Cursor, Zed, Gemini, etc.)
but not VS Code, even though cbm_install_vscode_mcp() already existed.
Add VS Code User config dir detection and wire it into both install
and uninstall flows, writing to ~/.config/Code/User/mcp.json (Linux)
or ~/Library/Application Support/Code/User/mcp.json (macOS).
VS Code 1.112+ validates that all MCP tool array-type parameters
include an "items" definition (microsoft/vscode#248810). The
ingest_traces tool's "traces" parameter was missing this, causing
startup failures.
The snippet handler now uses exact QN + suffix matching only (no fuzzy/auto-resolve).
Updated 3 tests to match: fuzzy_suggestions, fuzzy_last_segment, auto_resolve_enabled.
Incremental pipeline (pipeline_incremental.c):
- Disk-based delta re-indexing: classifies files by mtime+size vs stored
hashes, deletes changed nodes (edges cascade), re-parses only changed
files, merges into existing DB via cbm_gbuf_merge_into_store
- pipeline.c auto-routes: existing DB with hashes -> incremental, else full
- Full pipeline persists file hashes after dump for next incremental run
- No-op when nothing changed (watcher polls every 5-60s, 99% skip)
- 4 tests: noop, changed file, deleted file, new file added
ADR hints (ported from Go):
- index_repository: adr_present + adr_hint when no ADR exists
- get_graph_schema: adr_present + adr_hint per project
- manage_adr GET: adr_hint with creation instructions when no ADR
- Validate child exit status (WIFEXITED + WEXITSTATUS) after waitpid so
the test fails fast if the child couldn't open the store, rather than
passing vacuously due to the "crashed" row never being written
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Wrap bulk_crash_recovery test and its POSIX includes with #ifndef _WIN32
guards to fix compilation failure on Windows (fork/waitpid unavailable)
- Add negative assertion that the uncommitted "crashed" row is absent
after crash recovery, completing the test's correctness verification
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
cbm_store_begin_bulk() was switching the SQLite journal mode from WAL to
MEMORY for write throughput. If the process crashed mid-bulk-write the
in-memory rollback journal was lost, leaving the database file in a
partially-written, unrecoverable state.
WAL mode is inherently crash-safe: uncommitted WAL entries are discarded
on the next open. The performance benefit of bulk mode is preserved via
synchronous=OFF and an enlarged cache_size, both of which are safe under
WAL.
Remove the PRAGMA journal_mode = MEMORY from cbm_store_begin_bulk and
the matching PRAGMA journal_mode = WAL from cbm_store_end_bulk. Update
the header comments to reflect the new invariant.
Add tests/test_store_bulk.c with three tests:
- bulk_pragma_wal_invariant: asserts journal_mode remains "wal" after
cbm_store_begin_bulk via an independent read-only connection
- bulk_pragma_end_wal_invariant: asserts journal_mode remains "wal" after
cbm_store_end_bulk
- bulk_crash_recovery: forks a child that enters bulk mode, opens an
explicit transaction, writes data, then calls _exit() without committing;
the parent verifies the database opens cleanly and baseline data survives
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Call cbm_mem_collect() (mi_collect(true)) after pipeline_free in both
index_repository and auto-index, returning mimalloc pages to OS
- Add -static to Windows linker flags so the binary is standalone
(no libc++.dll / libunwind.dll dependency)
protocolVersion was {"version":"2024-11-05"} — MCP spec requires "2024-11-05".
Claude Code rejected the malformed response and marked the server as failed.
Background thread checks api.github.com/repos/.../releases/latest on initialize,
stores one-shot notice prepended to the first tools/call response content array.
Ported from Go internal/tools/tools.go checkForUpdate + addUpdateNotice pattern.
The cp command fails when SUFFIX is empty because source and destination
are the same file. Only copy when SUFFIX is non-empty (ui variant).
Also add fail-fast: false to smoke-windows so both variants always run.
The UI zip contains codebase-memory-mcp-ui.exe but the smoke test
always runs ./codebase-memory-mcp.exe. Copy the extracted binary
to the expected name so both standard and ui variants work.
MSYS2 mktemp returns /tmp/tmp.XXX but the Windows binary can't resolve
POSIX paths. Use cygpath -m to convert to C:/msys64/tmp/tmp.XXX which
works in both MSYS2 shell and Windows file APIs.
The dump phase writes to ~/.cache/codebase-memory-mcp/<project>.db
but the directory may not exist on fresh CI runners. Add cbm_mkdir_p()
to ensure the parent directory is created before writing. This fixes
smoke test failures where index_repository returned status "error"
because the dump phase couldn't create the database file.
1. smoke-windows: Use CLANG64 (not UCRT64) so runtime matches the
build environment. Binary built with CLANG64 needs CLANG64 DLLs.
2. smoke-unix: Add fail-fast: false so one platform failure doesn't
cancel all 7 other smoke jobs.
3. smoke-test.sh: Capture and display stderr on indexing failure to
help debug smoke-unix errors.
4. release.yml: Same CLANG64 smoke fix.
1. Add zip to MSYS2 build packages (both dry-run and release).
2. embed-frontend.sh: replace xxd with od+sed for hex dump — xxd
requires vim which isn't in MSYS2 CLANG64 by default.
3. embed-frontend.sh: flip IS_MACOS→IS_LINUX — Linux gets ld -r -b
binary (ELF-only), everything else (macOS, Windows) gets the
portable C-array approach via od.
4. release.yml: same Windows archive fix (msys2 shell + .exe detect).
1. dry-run.yml: Add skip_tests and skip_builds workflow_dispatch inputs
for faster iteration. Build jobs use always() to run even when tests
are skipped.
2. Windows archive: Switch from PowerShell Copy-Item to MSYS2 shell
with .exe extension detection. MSYS2 Clang produces .exe suffix
that Copy-Item didn't account for.
3. Linux embed: Use absolute path for ld output when cd'd into dist
directory. Relative path build/c/embedded/*.o was invalid from
inside graph-ui/dist/.
4. release.yml: Same Windows archive fix as dry-run.
1. cbm-with-ui target: add $(OBJS_VENDORED_PROD) as dependency so
grammar .o files are compiled before linking in parallel make.
Without this, make -jN fires the link step as soon as embed
finishes, racing against grammar compilations.
2. test_ui.c: replace system("mkdir -p") with cbm_mkdir_p() for
Windows compatibility. Add compat_fs.h include.
Two UI config tests (config_corrupt_file, config_missing_fields) used
Unix-only system("mkdir -p") to create test directories. On Windows this
fails with "The syntax of the command is incorrect." — replaced with the
portable cbm_mkdir_p() function already in compat_fs.h.
- parallel_for_actually_parallel: skip on single-core CI runners
instead of failing (assertion requires >= 2 concurrent threads)
- Fix mkdir -p → portable mkdir in test_ui.c config tests
- Skip store_dump_to_file and cli_find_cli_on_path on Windows
(temp file path handling and PATH search need porting)
Discover integration tests use system("rm -rf && mkdir -p && echo >")
which are Unix shell commands. These tests are properly skipped on
Windows with SKIP_UNIX_SHELL macro. The remaining 4 Windows test
failures (store_dump, cli_find, ui_config x2) need individual fixes.
TODO: Port discover test helpers to use C file operations.
The /tmp/ → %TEMP%\ translation produces longer paths (~50 chars)
than the original templates (~25 chars). Changed all 68 test
declarations from char tmpdir[] = "..." (sized to literal) to
char tmpdir[256] with snprintf initialization.
- Vendor TRE regex library (BSD-licensed, ~9K LOC) for Windows —
eliminates the TODO stub that caused all regex tests to fail
- Fix cbm_mkdtemp stack-buffer-overflow: use static buffer for
/tmp/ → %TEMP%\ path translation (Windows paths are longer)
- Wine test results: 1861 passed, 50 failed (Wine filesystem limits),
75 skipped — remaining failures are Wine-specific, not Windows bugs
- cbm_mkdtemp: translate /tmp/ to %TEMP%\ on Windows
- Docker test-windows: cross-compile + run under Wine (without ASan,
which doesn't work under Wine)
- Wine on PATH fix for Ubuntu noble (/usr/lib/wine/)
- Tool preflight check in Dockerfile
- 1887/1992 tests pass under Wine (52 fail: regex not available in
pure MinGW — works on real MSYS2 which provides <regex.h>)
- Use env: block instead of shell quoting for WIN32_LIBS in CI
- Forward WIN32_LIBS from environment in test.sh and build.sh
- Add skip_lint input to dry-run workflow for faster iteration
Martin Vogel