Add the missing success-path test for cbm_move_file_no_replace() and document the helper's POSIX link()+unlink() same-filesystem behavior.
The contract stays no-clobber: destination conflicts leave the source in place, and cross-device POSIX moves fail instead of silently copying or replacing.
Validation: CBM_ONLY_SUITE=security make -f Makefile.cbm test passed, 40 tests.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Stop deleting structurally corrupt derived cache DBs during MCP store resolution.
Move corrupt cache DBs to <project>.db.corrupt only when that quarantine target does not already exist, and keep the active corrupt cache path in place if quarantine fails. This is diagnostic quarantine, not a recovery backup.
Add cbm_move_file_no_replace() to keep no-overwrite move semantics centralized across POSIX and Windows, and use it for DB/WAL/SHM quarantine sidecars.
Verified with make -f Makefile.cbm build/c/test-runner, make -B -f Makefile.cbm build/c/codebase-memory-mcp, CBM_ONLY_SUITE=mcp (114 passed), and CBM_ONLY_SUITE=security (39 passed).
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
Make index writes and artifact refreshes use verified temp files plus atomic replacement, preserving Windows replace semantics and avoiding fixed temp-path collisions.
Thread the remaining pipeline confidence knobs through config while keeping zero-valued defaults backward compatible with existing upstream behavior.
Tighten route-node gates and architecture route output so infra URL nodes stay queryable in the graph but do not pollute get_architecture route summaries; preserve code-created absolute URL routes for all language extractors.
Harden MCP and CLI path handling around cache paths, grep scratch files, update downloads, checksum validation, stale checks, and project DB discovery without writing protocol noise to stdout.
Add regression coverage for corrupt-DB recovery, concurrent atomic writes, tmp-prefixed project DBs, duplicate search result fields, route output filtering, config registry entries, and focused suite selectors.
Validated with: git diff --check; make -f Makefile.cbm build/c/test-runner; focused suites security, artifact, graph_buffer, sqlite_writer, store_search, store_bulk, store_pragmas, store_checkpoint, watcher, infrascan, pipeline, store_nodes, mcp, cli, parallel, tool_consolidation, incremental, and store_arch; make -f Makefile.cbm cbm; isolated dogfood index/query run.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
The Windows search path landed in 82a9052 wraps shell args in cmd.exe-
level "powershell -Command \"...'%s'...\"". PowerShell's single quotes
hold the inner '%s' interpolation, but a literal " inside the user-
supplied value can close the cmd.exe outer quote. With ' ; | & $ `
already blocked, that wouldn't reach RCE on its own — but < and > were
unblocked, so a quote-break followed by cmd.exe redirection (e.g.
*">C:\evil.txt") would expose a file-write primitive.
Block " < > unconditionally. The validator's contract is "safe inside
single quotes for shell interpolation"; on POSIX these aren't strictly
necessary (single quotes hold), but on Windows the cmd.exe→powershell
wrapping makes them load-bearing, and unconditional blocking keeps the
validator simple — no ifdef-laddered policy and no surprises if a future
caller invokes it from a different shell context.
Three tests added to tests/test_security.c covering each new char.
Andrew Hundt