safe_stat reports a symlink as CBM_NOT_FOUND by policy, and
walk_dir_process_entry turned any CBM_NOT_FOUND into out->failed when
count_only was set. One symlink anywhere in a tree therefore aborted the
whole count.
cbm_discover_count_bounded is what auto-index admission calls (the MCP
session path and the daemon path), so any repository containing any
symlink could never auto-index: admission logged
reason=unsafe_or_unavailable_path files=-1 and returned. Nothing is unsafe
and the walk is not slow; the count simply refused at the first symlink it
met. Explicit index_repository was unaffected, because count_only is false
there and the same entry is skipped rather than fatal.
A count now skips symlinks and still aborts on an entry it genuinely cannot
observe, which is what the admission guard wants.
Carried from #1803 by Logan G onto current main. #1822 has since given
safe_stat an is_symlink out-param for the ignored-files report, so this
reuses it instead of adding a second is_link parameter; the production
change is the one condition. The regression test
discover_count_bounded_survives_a_symlink is the contributor's, aligned
with the neighbouring symlink tests: a visible SKIP_PLATFORM on Windows
instead of compiling it out, no wall-clock deadline (0 = none), and
th_cleanup of its temp tree.
Co-authored-by: Logan G <logan@gosolto.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The Windows half of ws_approve_sensitive_matches_across_separator_styles
asserted the sensitive-root hint for <cache>/.ssh/cfg/sub without creating
that directory. Containment canonicalizes the candidate, which on Windows
opens it (CreateFileW, OPEN_EXISTING), so a missing descendant was reported
as outside the allowed root and the assertion failed on the Windows shard.
Create it the way its parent is created.
The grant file is now written through cbm_fopen, the wrapper every
repository or user path goes through, in binary mode.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
main landed the same separator-equivalent comparison in 2e6dc087
(ws_prefix_equal), so the conflict in ws_is_ancestor_or_equal resolves to
main's helper; the #1718 comment above the function is kept. The two
test-file conflicts were both sides adding tests at the same place, and
keep both.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch onto current main. The only red in the PR's CI run,
incremental_deleted_spawner_drops_its_process, was a main-side failure at
the old base 56700bdb, fixed on main by 2317c2e7.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
When an agent greps for a symbol that the graph knows, the PreToolUse
augmentation (Grep, Glob and Bash searches) lists the matching symbols. It now
closes with one line that is cbm's own statement, outside the untrusted symbol
block, naming the graph tools for the usual next question:
[codebase-memory] For these symbols, trace_path lists callers and callees,
get_code_snippet returns the exact source, and search_graph finds related
symbols by name.
The line carries no repository-derived value and is stated as facts, as Claude
Code asks of hook context. It is appended at the string's real end into
reserved room: the list loop's offset can run past its cap when a row is
truncated, so appending at that offset could have written past the buffer.
Searches without a hit, errors and non-search events are unchanged.
Refs #509
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Review round 4 of #2677 (user decisions: R4-1..R4-4, R4-6, R4-7, R4-9;
R4-5 measured and left out). Every case ends in an UNKNOWN image, never a
wrong one.
Changes not run exactly (helm_template.c):
- A deep merge into a values map is not exact when a change was made at or
below its path (a set storing a map there): every values map a set or a
merge changes keeps its path, and such a merge leaves the images after it
UNKNOWN.
- and / or at an operand whose truth is not known -- UNKNOWN, or a map a
change made unknown -- leave the images after them UNKNOWN when an
operand after it may change maps.
- In an if / with an UNKNOWN condition skips, the else-if / else-with
conditions after it are looked at too: a change there taints, an
assignment there makes its variable UNKNOWN.
- sortAlpha sorts a []string in place: it counts as a change (a list is
never poisoned, so it taints). No other Sprig list function changes its
argument in place.
- A template, a define body or a scanned template file the grammar does not
parse may hide a change: its images are UNKNOWN.
Work (helm_template.c):
- A capture's keys leave the key set one by one; the set is no longer
cleared by walking its whole capacity after each capture.
- Template files are found by a hash of their path, and an include of a
name that is no define is answered once per render.
Known limit, documented (README): each template file renders on its own,
while Helm renders a chart's files with one shared .Values. Running them in
Helm's order is the planned follow-up; the coarse rule across files cost 83
more correct images on the 20 infra corpora and was left out.
On the 20 infra corpora: Image edges identical to round 4 (0 lost, 0
added), no budget trip.
Tests: R4-1..R4-4 and R4-9 fail on 3401def5 by their assertions (each sub
case too); R4-6 and R4-7 are correctness controls, their cost measured
outside the suite.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Conflict in tests/test_pipeline.c: this branch and #2703 (on main) each
registered two Go tests at the same place in the suite list; both pairs
are kept.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
When the PHP LSP knows a receiver's class but the class is not in the
index, it emits php_method_typed_unindexed at 0.55, below the LSP
confidence floor. The resolver skipped that row and the weak short-name
fallback bound the call to a same-named project method: `$file->getUid()`
on a vendor File became a CALLS edge to App\Item::getUid.
#2520 turns this row into php_external_receiver when a vendor `use`
proves the class external, but two cases still reach the fallback. A
global function import (`use function sprintf;`) leaves the file's import
bindings unproven, since #2705 proves only class imports absent. And a
vendor type that arrives through a return type
(`$repository->findFile()->getUid()`) has no `use` in the calling file
at all.
Both resolvers now drop a unique_name or suffix_match edge when the LSP
row names a receiver class that no project class-like symbol shares by
simple name. A project class with that name keeps the fallback, because
the PHP LSP does not follow every cross-file type.
The test pair covers both cases, through pass_calls.c and pass_parallel.c.
Each case is RED on main on its own (vendorCall, chainedVendorCall);
calls on a project-typed receiver and on $this still resolve. On a
211-file TYPO3 project PHP CALLS edges go from 1083 to 1059
(-18 suffix_match, -6 unique_name; typed php_* edges unchanged): 25
removed, and 1 that a removed edge on the same caller had absorbed.
Signed-off-by: Wolfgang Klinger <wolfgang@wazum.com>
Conflict in tests/test_edge_types_probe.c: both sides added tests after
et_handles_exact (the R1 + R2 DATA_FLOWS tests and the #1692 ASP.NET
overload test); both are kept.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The read-only analysis profile and the fast scout profile serve the graph
subagents (codebase-memory-auditor, codebase-memory-scout). Their server
instructions listed tools only. Like the default profile, they now state as
facts which structural questions the graph answers (where a symbol is defined,
who calls a function, what it calls, and for analysis also call chains, data
flow and change impact), keywords first: analysis 190 -> 648 characters, scout
199 -> 427, well within Claude Code's 4,096-character cut. The profile names,
check_index_coverage and the absence of index_repository are unchanged.
Stacked on #2698.
Refs #509
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Design decision 2026-10-18 (R1 + R2): a handler defined in a test file
pairs only with callers in that same file, and a caller in a test file
pairs only with handlers in that same file. A test's request to the
application, a production caller matched to a test's mock server, and
the private mock servers of two tests pairing across files are not
data flows of the application. #2689 links every caller of a route to
every handler of it, so these pairs were made on main.
try_create_data_flow now refuses a pair whose caller or handler is in a
test file (cbm_is_test_file, the per-language rule extraction uses)
when the two files differ. HTTP_CALLS and HANDLES are unchanged; only
the pairing is scoped. The pass log counts the refused pairs
(skipped_test_scope).
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Design decision 2026-10-18 (R1 + R2): a DATA_FLOWS caller in a test file
pairs only with handlers in that same file, and a handler in a test
file pairs only with callers in that same file.
infrascan: test callers by each language rule (a tests/ directory, a
Java *Test.java, a TS .spec.ts) get no flow to a production handler; a
production caller gets no flow to a test mock server; a test reaches
the mock server of its own file but not one in another test file.
Controls: a production caller keeps its flow, and so does a same-file
test pair.
edge_types_probe: a Spring controller, a mock controller under
src/test/, a production TS client and a TS .test.ts client meet on
the same __route__ANY__ nodes. Exactly one flow (production client to
production controller) on the sequential and on the parallel path.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel