Add cbm_get_home_dir() in platform.c: tries HOME first, then
USERPROFILE (Windows). Replace all 17 raw getenv("HOME") callsites.
Fallback from "/tmp" to cbm_tmpdir() for cross-platform temp dir.
Cherry-picked from PR #88 by @bingh0. Fixes#77.
- clang-format: fix alignment in userconfig.c and userconfig.h
- Magic number 1280 → PATH_BUF_SZ named constant
- Remove dead g-- before break in dedup loop (cppcheck)
- Add "Custom File Extensions" section to README documenting
.codebase-memory.json and global config
- Commit format table: feat, fix, test, refactor, perf, docs, chore
(adapted from @halindrome's PR #85)
- One issue per PR: no bundling multiple fixes/features
- Open an issue first: every PR must reference a tracking issue
Based on feedback from @halindrome (#84, #85) who identified the need
for structured PR guidelines and commit conventions.
- Delete cmd/codebase-memory-mcp/assets/ — skills and codex instructions
are embedded as C string literals in src/cli/cli.c since v0.5.0
- Move BENCHMARK.md to docs/ to reduce root clutter
- Fix setup scripts: replace stale go build with scripts/build.sh
- THIRD_PARTY.md: replace Go module dependencies with vendored C
libraries (sqlite3, mimalloc, mongoose, yyjson, xxhash, tre),
fix CGo reference to static compilation
- server.json: update version 0.3.1→0.5.5, 35→64 languages,
SHA-256 hashes for current release binaries
- Remove Go Makefile (Go→C migration complete since v0.5.0)
The parallel execution path (used for repos above MIN_FILES_FOR_PARALLEL)
was missing the cbm_pipeline_pass_k8s() call. The pass existed only in
the sequential fallback path, so any repo large enough to trigger parallel
indexing produced zero k8s Resource and kustomize Module nodes.
Discovered via live testing against a 954-file gitops repo: the parallel
path was taken, k8s pass was silently skipped, and search_graph returned
0 Resource nodes despite 213 kustomize overlays and hundreds of manifests.
Add the pass after cbm_parallel_resolve() in the parallel branch, matching
the same pattern (fail-open, cancel check, timing log) as the sequential path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Check return value of cbm_pipeline_pass_k8s() in incremental path;
log warning on failure (fail-open, matches full pipeline behaviour)
- Add comment documenting pass ordering and the two known structural
limitations: File→Resource DEFINES edges and cross-file kustomize
IMPORTS edges are not emitted in incremental (gbuf only contains
nodes for changed files; File nodes from pass_structure are absent)
- Fix clang-format violation in incremental_kustomize_module_indexed
test (single-line if condition)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
cbm_pipeline_pass_k8s() was called in the full pipeline (pipeline.c)
but absent from pipeline_incremental.c. This meant k8s Resource nodes
and kustomize Module nodes were never created or updated during
incremental re-indexing — only after a fresh full index.
Add the pass after the semantic pass, following the same timing-log
pattern as the other incremental passes. Pass changed_files (not the
full file list) so only modified/added YAML files are re-processed.
Add two regression tests:
- incremental_k8s_manifest_indexed: full index + add manifest via
incremental, verifies Resource node appears in the DB
- incremental_kustomize_module_indexed: same for kustomization.yaml
Module node
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Archives >3MB may not be unpacked by VirusTotal, meaning only the
container gets scanned (meaningless). Now extracts the actual
executables from tar.gz/zip before uploading to VirusTotal.
Users still download archives (preserves Unix permissions).
Also fixes analysis ID parsing (base64 format, not SHA256).
Also fixes SBOM format (SPDX 2.3 instead of CycloneDX).
- Add explicit fallback path when fcntl(F_GETFL) fails: skip the FILE*
peek and fall through directly to blocking poll so idle eviction still
fires on timeout (Finding 1)
- Strengthen C unit test: verify id:1 (initialize) and id:2 (tools/list)
response IDs are both present, not just a substring match on "tools"
(Finding 2)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Use O_NONBLOCK + clearerr() in Phase 2 fgetc probe to preserve the
60s idle eviction timeout when both kernel fd and FILE* buffer are
empty (fgetc on a blocking fd would otherwise block indefinitely,
bypassing Phase 3 poll timeout and preventing cbm_mcp_server_evict_idle)
- Add #include <fcntl.h> for fcntl()/O_NONBLOCK
- Fix comment: "two-phase" → "three-phase" (implementation has 3 phases)
- Improve Python integration test: verify id:1 (initialize) and id:2
(tools/list) response IDs are both present, not just "tools" substring
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Build fails at pass_githistory.c:171 with:
error: missing field 'interhunk_lines' initializer
[-Werror,-Wmissing-field-initializers]
git_diff_options diff_opts = GIT_DIFF_OPTIONS_INIT;
codebase-memory-mcp at 75b5dcb has this issue. The GIT_DIFF_OPTIONS_INIT
macro does not list all struct fields, which clang flags as an error
under -Werror.
Replace the macro with the runtime git_diff_options_init() API, which
properly initializes all fields. Available since libgit2 0.28.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Wait until at least 60 engines have actually scanned (not just
reported type-unsupported/failure/timeout)
- 20 minute timeout per binary (was 5 minutes)
- If scan doesn't complete in time → FAIL (incomplete scan is not clean)
- Engines that can't scan (type-unsupported, failure, timeout) are
excluded from the completion count
freshclam requires DatabaseMirror set in config. Without it, ClamAV
scans with empty signatures (catches nothing). Now properly configures
freshclam.conf on both Linux (apt) and macOS (Homebrew) before updating.
Every platform now has a real antivirus gate that fails the build:
- Windows: Windows Defender with ML heuristics (MpCmdRun.exe)
- Linux: ClamAV with freshclam signature update
- macOS: ClamAV with freshclam signature update
Any detection on any platform blocks the release-draft from being
created. This is on top of the VirusTotal zero-tolerance gate in
the verify job.
SECURITY.md updated with complete security architecture.
Martin Vogel