mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-28 07:03:20 +08:00
Andrew Hundt
41bac690a9
Add a root-overridable self-test harness for scripts/check-source-safety.sh so the guard can be tested against synthetic trees without scanning the real repository. Cover clean input, MCP/server stdout writes, unsafe string APIs, and new raw filesystem APIs in production diffs. Add a dedicated lint-source-safety target because the broader lint-no-suppress path is currently blocked by existing NOLINT audit failures before this guard can run. Validation: bash scripts/test-source-safety.sh; bash scripts/check-source-safety.sh; git diff --check; make -f Makefile.cbm lint-source-safety. Signed-off-by: Andrew Hundt <ATHundt@gmail.com>
93 lines
3.1 KiB
Bash
93 lines
3.1 KiB
Bash
#!/usr/bin/env bash
|
|
# check-source-safety.sh — source-level safety and protocol-output guard.
|
|
#
|
|
# This complements clang/cppcheck by enforcing project conventions that generic
|
|
# linters cannot infer:
|
|
# - MCP/server runtime code must not write protocol-breaking text to stdout.
|
|
# - Production source must not add unsafe unbounded string-copy helpers.
|
|
# - New production diffs should use CBM platform wrappers for env/fs APIs.
|
|
set -uo pipefail
|
|
|
|
ROOT="${CBM_SOURCE_SAFETY_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
|
|
violations=0
|
|
|
|
add_violation() {
|
|
echo "[source-safety] $*"
|
|
violations=$((violations + 1))
|
|
}
|
|
|
|
is_allowed_unsafe_string_hit() {
|
|
local hit="$1"
|
|
case "$hit" in
|
|
"$ROOT/src/foundation/compat.c":*"strcpy(tmpl, buf);"*) return 0 ;;
|
|
src/foundation/compat.c:*"strcpy(tmpl, buf);"*) return 0 ;;
|
|
esac
|
|
return 1
|
|
}
|
|
|
|
grep_source() {
|
|
local pattern="$1"
|
|
shift
|
|
if git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
git -C "$ROOT" grep -nE "$pattern" -- "$@" 2>/dev/null || true
|
|
else
|
|
local paths=()
|
|
local p
|
|
for p in "$@"; do
|
|
paths+=("$ROOT/$p")
|
|
done
|
|
grep -RInE "$pattern" "${paths[@]}" 2>/dev/null || true
|
|
fi
|
|
}
|
|
|
|
while IFS= read -r hit; do
|
|
[ -n "$hit" ] || continue
|
|
case "$hit" in
|
|
*/vendored/*|*/build/*|internal/cbm/vendored/*) continue ;;
|
|
esac
|
|
if ! is_allowed_unsafe_string_hit "$hit"; then
|
|
add_violation "unsafe string API in production source: $hit"
|
|
fi
|
|
done < <(
|
|
grep_source '\b(strcpy|strcat|sprintf|gets)[[:space:]]*\(' src internal cmd
|
|
)
|
|
|
|
while IFS= read -r hit; do
|
|
[ -n "$hit" ] || continue
|
|
case "$hit" in
|
|
*/vendored/*|*/build/*|internal/cbm/vendored/*) continue ;;
|
|
esac
|
|
add_violation "stdout write in MCP/server pipeline code: $hit"
|
|
done < <(
|
|
grep_source '\b(printf|puts|putchar)[[:space:]]*\(|fprintf[[:space:]]*\([[:space:]]*stdout' \
|
|
src/mcp src/pipeline src/graph_buffer src/semantic internal/cbm
|
|
)
|
|
|
|
if git -C "$ROOT" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
diff_text="$(
|
|
git -C "$ROOT" diff --unified=0 -- src internal cmd 2>/dev/null
|
|
git -C "$ROOT" diff --cached --unified=0 -- src internal cmd 2>/dev/null
|
|
)"
|
|
while IFS= read -r line; do
|
|
case "$line" in
|
|
+++*|"+" ) continue ;;
|
|
+*)
|
|
if [[ "$line" =~ (^|[^A-Za-z0-9_])(unlink|rename|remove|rmdir|mkdir|getenv|setenv|unsetenv|mkstemp|mkdtemp)[[:space:]]*\( ]]; then
|
|
add_violation "new raw env/fs API in production diff, use CBM compat wrapper or document an exception: $line"
|
|
fi
|
|
;;
|
|
esac
|
|
done <<< "$diff_text"
|
|
fi
|
|
|
|
if [ "$violations" -gt 0 ]; then
|
|
echo ""
|
|
echo "[source-safety] FAIL: $violations violation(s)."
|
|
echo " Use cbm_safe_getenv/cbm_setenv/cbm_unsetenv and compat_fs wrappers where applicable."
|
|
echo " Keep MCP stdio stdout reserved for JSON-RPC protocol messages; diagnostics go to stderr/logs."
|
|
exit 1
|
|
fi
|
|
|
|
echo "[source-safety] OK — protocol stdout and source safety checks passed"
|
|
exit 0
|