Martin Vogel 98e98c3208 fix: cap client-driven traversal depth (var-length Cypher + MCP tools) ...

Explicit variable-length Cypher bounds ([:CALLS*1..N]) and the client
`depth` on trace_call_path / detect_changes were passed straight into
cbm_store_bfs, so an arbitrarily large value drove an unbounded traversal
(a DoS on cyclic graphs). The MCP_MAX_DEPTH ceiling was defined but never
applied, and CYP_MAX_DEPTH capped only the unbounded var-length forms.

Add env-configurable ceilings cbm_cypher_max_depth() (CBM_CYPHER_MAX_DEPTH,
default 10) and cbm_mcp_max_depth() (CBM_MCP_MAX_DEPTH, default 15), clamp
both entry points to them, and WARN on clamp -- never a silent truncation.
Remove the now-dead CYP_MAX_DEPTH / MCP_MAX_DEPTH constants.

Reproduce-first: cypher_exec_var_length_explicit_bound_capped (12 -> 10 rows)
and tool_trace_call_path_depth_clamped (depth 1000 -> hop 15).

Closes #887.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

2026-07-05 16:13:00 +02:00

..

repro

Merge remote-tracking branch 'origin/main' into feat/index-mem-subprocess-isolation

2026-07-04 18:42:43 +02:00

windows

test(windows): convert fixed reds to green guards, wire CI, rewrite drive test

2026-07-04 13:22:41 +02:00

grammar_cases.h

Add per-grammar regression suite across all 159 grammars

2026-06-05 21:53:25 +02:00

scale_contract.sh

Add per-grammar regression suite across all 159 grammars

2026-06-05 21:53:25 +02:00

smoke_guard.sh

fix(mcp,store): address QA round 2

2026-03-22 18:33:10 -05:00

test_ac.c

Resolve all clang-tidy, cppcheck, and clang-format warnings across 94 files

2026-03-15 22:37:34 +01:00

test_arena.c

fix(arena): NULL-arena guard in cbm_arena_alloc; skip vendored/ dirs

2026-05-30 18:26:44 +02:00

test_artifact.c

fix: address review feedback on artifact export error surfacing

2026-06-22 14:46:29 -07:00

test_ast_profile.c

fix: char buf[1] = "X" → {'X'} for -Wunterminated-string-initialization on Windows/clang

2026-06-29 09:45:28 -06:00

test_c_lsp.c

fix(lsp): seal shared Tier-2 cross-registry against O(n^2) resolve hang

2026-06-29 01:33:40 +02:00

test_cli.c

Merge pull request #664 from mvanhorn/feat/651-feat-auto-install-support-for-the-junie-

2026-07-05 01:23:46 +02:00

test_configlink.c

WIP: strict linting + RAM-first pipeline (lint fixes pending)

2026-04-01 23:22:44 +02:00

test_convergence_probe.c

Add convergence + matrix probe suites; triage confirms no new root-cause classes

2026-06-07 18:29:05 +02:00

test_cpp_index_hang.sh

Fix O(n^2) overload resolution in the C/C++ cross-LSP registry (#410)

2026-06-06 22:16:04 +02:00

test_cs_lsp_bench.c

Forbid test skips and convert existing skips to hard failures

2026-06-05 21:53:25 +02:00

test_cs_lsp.c

feat(lsp): add C# / .NET hybrid LSP resolver

2026-05-19 22:47:53 +02:00

test_cypher.c

fix: cap client-driven traversal depth (var-length Cypher + MCP tools)

2026-07-05 16:13:00 +02:00

test_discover.c

fix(discover): .cbmignore negation can un-skip built-in dirs (safety core excluded)

2026-07-03 19:25:00 +02:00

test_dump_verify_io.c

Add post-dump plausibility gate returning status:degraded (#334)

2026-06-23 06:38:45 +09:00

test_dump_verify.c

Add post-dump plausibility gate returning status:degraded (#334)

2026-06-23 06:38:45 +09:00

test_dyn_array.c

Fix Windows build: add missing stdint.h include in test_dyn_array

2026-03-25 09:28:11 +01:00

test_edge_imports.c

Add graph-level edge-creation reproduction suite (pipeline edge resolution)

2026-06-07 13:00:55 +02:00

test_edge_structural.c

Add graph-level edge-creation reproduction suite (pipeline edge resolution)

2026-06-07 13:00:55 +02:00

test_edge_types_probe.c

fix(extract): compose Spring controller route prefixes

2026-07-03 10:08:01 +09:00

test_extraction_imports.c

Add language-agnostic extraction reproduction suite (inheritance + imports)

2026-06-07 12:35:53 +02:00

test_extraction_inheritance.c

Fix CI lint: drop debug scaffolding, make lisp import walker iterative, apply clang-format

2026-06-08 22:55:23 +02:00

test_extraction.c

fix(extract-rust): mark #[test]/#[tokio::test] fns is_test so they are filtered

2026-07-04 14:22:13 -03:00

test_fqn.c

fix(fqn): cap derived project-name length to avoid ENAMETOOLONG

2026-07-01 21:23:12 +02:00

test_framework.h

Forbid test skips and convert existing skips to hard failures

2026-06-05 21:53:25 +02:00

test_git_context.c

fix(test): guard git_context git helpers behind #ifndef _WIN32

2026-07-02 00:37:52 +02:00

test_gitignore.c

fix(discover): make cbm_gitignore_merge atomic on allocation failure

2026-06-22 23:51:49 +02:00

test_go_lsp.c

Resolve all clang-tidy, cppcheck, and clang-format warnings across 94 files

2026-03-15 22:37:34 +01:00

test_grammar_imports.c

Add per-grammar regression suite across all 159 grammars

2026-06-05 21:53:25 +02:00

test_grammar_labels.c

fix(kotlin): inject kotlin.Any nodes so lsp_kt_any edges form

2026-06-28 19:00:10 +02:00

test_grammar_probe_a.c

Add grammar-only probe suites (~35 code grammars); +1 new root-cause class

2026-06-07 19:13:01 +02:00

test_grammar_probe_b.c

Add grammar-only probe suites (~35 code grammars); +1 new root-cause class

2026-06-07 19:13:01 +02:00

test_grammar_probe_c.c

Add grammar-only probe suites (~35 code grammars); +1 new root-cause class

2026-06-07 19:13:01 +02:00

test_grammar_probe_d.c

fix(test): resolve 18 make-test regressions from the marathon batch

2026-06-27 16:23:26 +02:00

test_grammar_probe_e.c

Complete 159-grammar coverage: IDL/template/IaC/markup/remaining-code probes; +1 new class

2026-06-07 20:05:24 +02:00

test_grammar_probe_f.c

Complete 159-grammar coverage: IDL/template/IaC/markup/remaining-code probes; +1 new class

2026-06-07 20:05:24 +02:00

test_grammar_probe_g.c

fix(test): resolve 18 make-test regressions from the marathon batch

2026-06-27 16:23:26 +02:00

test_grammar_regression.c

Drop the nim grammar and refresh language counts

2026-06-12 02:17:39 +02:00

test_graph_buffer.c

fix(graph): IMPORTS edges keyed by local_name across buffer, store and dump

2026-07-03 20:16:39 +02:00

test_hash_table.c

perf(foundation): swap CBMHashTable internals to Verstable v2.2.1

2026-05-21 22:52:16 +02:00

test_helpers.h

Eliminate NOLINTNEXTLINE suppressions + iterative AST walkers

2026-03-31 20:04:11 +02:00

test_httpd.c

feat(graph-ui): dead-code filtering, node code preview, GitHub deep-links

2026-07-04 22:19:53 +02:00

test_incremental.c

test(incremental): raise x86 RSS budget 2048->2304 for post-retention baseline

2026-07-04 23:03:12 +02:00

test_index_resilience.c

feat(index): report per-file indexing failures via skipped[] + logfile (Stage 2/B2-B4)

2026-07-02 22:11:00 +02:00

test_infrascan.c

fix: Reject filesystem paths in HTTP_CALLS route extraction so client routes can join server routes (#485)

2026-06-22 22:04:31 +02:00

test_integration.c

fix(mcp): trace_path cross_service follows CROSS_* edges (#522) (#538)

2026-06-22 22:05:18 +02:00

test_java_lsp_coverage.c

feat(lsp): Java hybrid LSP resolver (type-aware calls, annotations, signatures)

2026-06-02 18:52:37 +02:00

test_java_lsp.c

feat(lsp): Java hybrid LSP resolver (type-aware calls, annotations, signatures)

2026-06-02 18:52:37 +02:00

test_kotlin_lsp.c

Add Kotlin hybrid LSP resolver

2026-06-03 01:33:25 +02:00

test_lang_contract.c

fix(pipeline): reject non-file-like IMPORTS targets in fallback strategies

2026-07-02 21:20:22 +08:00

test_language.c

Drop the nim grammar and refresh language counts

2026-06-12 02:17:39 +02:00

test_log.c

fix(logging): use local log schema

2026-06-28 13:05:05 +02:00

test_lsp_resolution_probe.c

fix(resolver): suppress weak short-name matches for TS/JS method calls

2026-07-04 14:34:26 +09:00

test_lz4.c

Resolve all clang-tidy, cppcheck, and clang-format warnings across 94 files

2026-03-15 22:37:34 +01:00

test_main.c

Merge pull request #853 from DeusData/feat/index-mem-subprocess-isolation

2026-07-04 20:50:14 +02:00

test_matrix_known_classes.c

Fix CI lint: drop debug scaffolding, make lisp import walker iterative, apply clang-format

2026-06-08 22:55:23 +02:00

test_matrix_new_constructs.c

Add convergence + matrix probe suites; triage confirms no new root-cause classes

2026-06-07 18:29:05 +02:00

test_mcp.c

fix: cap client-driven traversal depth (var-length Cypher + MCP tools)

2026-07-05 16:13:00 +02:00

test_mem.c

fix(test): harden mem_rss WorkingSetSize check for windows-11-arm

2026-07-05 04:14:32 +02:00

test_node_creation_probe.c

Drop the nim grammar and refresh language counts

2026-06-12 02:17:39 +02:00

test_parallel.c

fix(index): bound + source-cap parallel retention with re-read fallback (low-RAM peak RSS)

2026-07-04 18:38:58 +02:00

test_parent_watchdog.sh

fix(main): exit promptly after parent death

2026-07-02 21:43:07 +03:00

test_path_alias.c

fix(pipeline): honor discovery exclusions in pkgmap/path-alias/envscan walks

2026-07-03 19:57:01 +02:00

test_php_lsp.c

feat(php-lsp): @phpstan-type aliases + Closure::bind + variance + 30 tests

2026-05-09 16:05:45 +02:00

test_pipeline.c

fix(resolver): suppress weak short-name matches for TS/JS method calls

2026-07-04 14:34:26 +09:00

test_platform.c

test(platform): use cbm_setenv/cbm_unsetenv for Windows portability

2026-05-30 20:15:30 +02:00

test_py_lsp_bench.c

Forbid test skips and convert existing skips to hard failures

2026-06-05 21:53:25 +02:00

test_py_lsp_scale.c

perf(py_lsp): cap dedup window at 256 entries — 91.8x -> 31.4x scaling

2026-05-09 15:44:09 +02:00

test_py_lsp_stress.c

feat(py_lsp): close all stress gaps — lambda, dict-dispatch, async, callable, next, kwargs

2026-05-09 14:16:15 +02:00

test_py_lsp.c

fix(py-lsp): memoize + guard expression evaluation (exponential re-eval hang)

2026-07-03 19:49:03 +02:00

test_registry.c

fix(resolver): suppress weak short-name matches for TS/JS method calls

2026-07-04 14:34:26 +09:00

test_route_canon.c

fix(routes): canonicalize path parameters so client calls match handlers

2026-06-23 13:52:08 -03:00

test_rust_lsp.c

Add Rust hybrid LSP resolver

2026-06-03 02:13:30 +02:00

test_scope.c

refactor(lsp): chunked linked-frame CBMScope + MRO depth cap

2026-05-08 22:26:56 +02:00

test_security_strings_allowlist.sh

fix(ci): allow-list MSYS2 toolchain URL in binary string audit

2026-06-24 03:15:36 +02:00

test_security.c

fix(windows): spawn git without inheriting handles (UI hang)

2026-07-04 13:36:45 +02:00

test_semantic.c

test: add 56 unit tests for semantic, slab_alloc, and ast_profile modules

2026-06-28 21:57:35 -06:00

test_simhash.c

Forbid test skips and convert existing skips to hard failures

2026-06-05 21:53:25 +02:00

test_slab_alloc.c

test: add 56 unit tests for semantic, slab_alloc, and ast_profile modules

2026-06-28 21:57:35 -06:00

test_sqlite_writer.c

fix(graph): IMPORTS edges keyed by local_name across buffer, store and dump

2026-07-03 20:16:39 +02:00

test_stack_overflow.c

fix(py-lsp): memoize + guard expression evaluation (exponential re-eval hang)

2026-07-03 19:49:03 +02:00

test_store_arch.c

fix(arch): normalize path trailing slashes; align MCP path_scoped with store (#604)

2026-06-24 12:54:45 +00:00

test_store_bulk.c

Fix Windows bulk test + dual MCP config location + CONTRIBUTING.md

2026-03-20 20:32:38 +01:00

test_store_checkpoint.c

test: use portable temp dir/paths so Windows unit tests pass

2026-05-29 03:37:56 +02:00

test_store_edges.c

fix(graph): IMPORTS edges keyed by local_name across buffer, store and dump

2026-07-03 20:16:39 +02:00

test_store_nodes.c

fix(store): accept lowercase drive letters in root_path integrity check

2026-05-31 12:50:19 +02:00

test_store_pragmas.c

test: use portable temp dir/paths so Windows unit tests pass

2026-05-29 03:37:56 +02:00

test_store_search.c

fix: address self-review findings — keep node_degree CALLS-only

2026-06-23 04:08:36 -07:00

test_str_intern.c

Add 480+ tests, fix 3 bugs discovered by new test coverage

2026-03-24 23:48:23 +01:00

test_str_util.c

fix(foundation): properly escape JSON control characters as \u00XX

2026-06-24 20:33:52 +05:30

test_subprocess.c

fix(win): escape spawned command-line args so the index worker gets valid argv

2026-07-05 13:48:00 +02:00

test_traces.c

Add 480+ tests, fix 3 bugs discovered by new test coverage

2026-03-24 23:48:23 +01:00

test_ts_lsp.c

Extend the notices bundle to the UI dependencies and the Glama image

2026-06-12 10:51:11 +02:00

test_type_rep.c

Fix uninitialized template-arg arrays binding stack garbage into type graphs

2026-06-10 12:11:02 +02:00

test_ui.c

feat(graph-ui): dead-code filtering, node code preview, GitHub deep-links

2026-07-04 22:19:53 +02:00

test_userconfig.c

Add missing platform.h include for cbm_safe_getenv in userconfig test

2026-04-06 14:34:07 +02:00

test_vmem.c

Forbid test skips and convert existing skips to hard failures

2026-06-05 21:53:25 +02:00

test_watcher.c

feat(watcher): prune projects whose root stays missing (ENOENT-only, grace window)

2026-07-03 20:40:22 +02:00

test_worker_pool.c

Make parallel_for_actually_parallel deterministic

2026-06-06 19:48:48 +02:00

test_worker_watchdog.sh

fix(supervisor): wrap only marked host binaries; watchdog in worker mode

2026-07-04 14:38:25 +02:00

test_yaml.c

Add 480+ tests, fix 3 bugs discovered by new test coverage

2026-03-24 23:48:23 +01:00

test_zstd.c

feat: add persistent artifact storage for team sharing

2026-04-15 23:56:03 +02:00