mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-01 07:44:01 +08:00
Andrew Hundt
ecc8e4d43b
Stabilize several graph-producing paths and add stronger regression coverage before the incremental redesign work continues. Key changes: - resolve call import maps from resolved graph-buffer IMPORTS edges so re-exported targets are reused consistently - make semantic, similarity, complexity, route/section upserts, and resolver scoring more deterministic across full/incremental and worker-order differences - propagate incremental phase/persist failures instead of continuing toward publication after failed phases - add canonical graph diff helpers and stricter incremental artifacts for full-vs-incremental comparison - add source-safety lint coverage for MCP stdout, unsafe string APIs, and new raw env/fs API usage - replace touched unsafe string copies with bounded or project-wrapper-based forms Validation: - make -f Makefile.cbm build/c/test-runner - CBM_ONLY_SUITE=pipeline ./build/c/test-runner: 217 passed - CBM_ONLY_SUITE=graph_buffer ./build/c/test-runner: 55 passed - CBM_ONLY_SUITE=mcp ./build/c/test-runner: 117 passed - CBM_ONLY_SUITE=simhash ./build/c/test-runner: 24 passed - CBM_ONLY_SUITE=parallel ./build/c/test-runner: 21 passed - CBM_ONLY_SUITE=watcher ./build/c/test-runner: 57 passed - bash scripts/check-source-safety.sh: OK Known remaining: - CBM_ONLY_SUITE=incremental still fails incr_accuracy_vs_full: 159 passed, 1 failed. Current artifacts show stale IMPORTS/CALLS/USAGE targets in unchanged importers and downstream SEMANTICALLY_RELATED drift; this is tracked in the forensic notes as a fallback-first incremental redesign task. Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
88 lines
2.9 KiB
Bash
88 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# check-source-safety.sh — source-level safety and protocol-output guard.
|
|
#
|
|
# This complements clang/cppcheck by enforcing project conventions that generic
|
|
# linters cannot infer:
|
|
# - MCP/server runtime code must not write protocol-breaking text to stdout.
|
|
# - Production source must not add unsafe unbounded string-copy helpers.
|
|
# - New production diffs should use CBM platform wrappers for env/fs APIs.
|
|
set -uo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
violations=0
|
|
|
|
add_violation() {
|
|
echo "[source-safety] $*"
|
|
violations=$((violations + 1))
|
|
}
|
|
|
|
is_allowed_unsafe_string_hit() {
|
|
local hit="$1"
|
|
case "$hit" in
|
|
"$ROOT/src/foundation/compat.c":*"strcpy(tmpl, buf);"*) return 0 ;;
|
|
src/foundation/compat.c:*"strcpy(tmpl, buf);"*) return 0 ;;
|
|
esac
|
|
return 1
|
|
}
|
|
|
|
grep_source() {
|
|
local pattern="$1"
|
|
shift
|
|
if git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
git -C "$ROOT" grep -nE "$pattern" -- "$@" 2>/dev/null || true
|
|
else
|
|
grep -RInE "$pattern" "$@" 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
while IFS= read -r hit; do
|
|
[ -n "$hit" ] || continue
|
|
case "$hit" in
|
|
*/vendored/*|*/build/*|internal/cbm/vendored/*) continue ;;
|
|
esac
|
|
if ! is_allowed_unsafe_string_hit "$hit"; then
|
|
add_violation "unsafe string API in production source: $hit"
|
|
fi
|
|
done < <(
|
|
grep_source '\b(strcpy|strcat|sprintf|gets)[[:space:]]*\(' src internal cmd
|
|
)
|
|
|
|
while IFS= read -r hit; do
|
|
[ -n "$hit" ] || continue
|
|
case "$hit" in
|
|
*/vendored/*|*/build/*|internal/cbm/vendored/*) continue ;;
|
|
esac
|
|
add_violation "stdout write in MCP/server pipeline code: $hit"
|
|
done < <(
|
|
grep_source '\b(printf|puts|putchar)[[:space:]]*\(|fprintf[[:space:]]*\([[:space:]]*stdout' \
|
|
src/mcp src/pipeline src/graph_buffer src/semantic internal/cbm
|
|
)
|
|
|
|
if git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
diff_text="$(
|
|
git -C "$ROOT" diff --unified=0 -- src internal cmd 2>/dev/null
|
|
git -C "$ROOT" diff --cached --unified=0 -- src internal cmd 2>/dev/null
|
|
)"
|
|
while IFS= read -r line; do
|
|
case "$line" in
|
|
+++*|"+" ) continue ;;
|
|
+*)
|
|
if [[ "$line" =~ (^|[^A-Za-z0-9_])(unlink|rename|remove|rmdir|mkdir|getenv|setenv|unsetenv|mkstemp|mkdtemp)[[:space:]]*\( ]]; then
|
|
add_violation "new raw env/fs API in production diff, use CBM compat wrapper or document an exception: $line"
|
|
fi
|
|
;;
|
|
esac
|
|
done <<< "$diff_text"
|
|
fi
|
|
|
|
if [ "$violations" -gt 0 ]; then
|
|
echo ""
|
|
echo "[source-safety] FAIL: $violations violation(s)."
|
|
echo " Use cbm_safe_getenv/cbm_setenv/cbm_unsetenv and compat_fs wrappers where applicable."
|
|
echo " Keep MCP stdio stdout reserved for JSON-RPC protocol messages; diagnostics go to stderr/logs."
|
|
exit 1
|
|
fi
|
|
|
|
echo "[source-safety] OK — protocol stdout and source safety checks passed"
|
|
exit 0
|