Merge branch 'main' into fm/cbm-worktree-ignore-1

Author: vitalNohj

Makefile.cbm

@@ -75,7 +75,8 @@ endif
 # CBM_BIND_TS_ALLOCATOR=1: bind the tree-sitter runtime to mimalloc (#424). Only
 # the prod build uses mimalloc (MI_OVERRIDE=1); the test build is CRT+ASan, where
 # binding would create an alloc/free mismatch, so the guard is prod-only.
-CFLAGS_PROD = $(CFLAGS_COMMON) -O2 -DCBM_BIND_TS_ALLOCATOR=1 $(TEST_SEAM_DEFINE) $(CFLAGS_EXTRA)
+CFLAGS_PROD = $(CFLAGS_COMMON) -O2 -DCBM_BIND_TS_ALLOCATOR=1 $(TEST_SEAM_DEFINE) \
+              $(GLOBAL_OVERRIDE_DEFINE) $(CFLAGS_EXTRA)
 CXXFLAGS_PROD = $(CXXFLAGS_COMMON) -O2
 
 # Test flags: debug + sanitizers (override SANITIZE= to disable on Windows)
@@ -386,9 +387,34 @@ UI_SRCS = \
 # derives it from the MI_OVERRIDE option); MI_OVERRIDE alone is not read by the
 # source — it is kept here only as this project's prod/test marker.
 MIMALLOC_SRC = vendored/mimalloc/src/static.c
+# Linux belongs on this list too (#1360). The "Unix relies on static-link-order
+# override" strategy described above never actually worked: mimalloc defines
+# malloc/free ONLY when MI_MALLOC_OVERRIDE is set (it gates alloc-override.c),
+# so with the define off there were no strong symbols for the link order to
+# prefer. Measured on the shipped v0.9.1-rc.1 artifacts — linux-arm64 glibc AND
+# musl-static both report 0/6 allocator-owned size classes, i.e. ordinary malloc
+# was going to libc and every purge/reclaim option set in cbm_mem_init applied
+# only to the bound sqlite/tree-sitter populations.
+#
+# The macOS objection does not transfer. That abort is specific to the two-level
+# namespace, where this binary's free becomes mi_free while system libraries keep
+# allocating from the system allocator, so a pointer crossing the boundary hits
+# "mi_free: invalid pointer". ELF is a flat namespace: interposition is
+# process-wide and all-or-nothing, which is the configuration mimalloc is
+# normally deployed in. macOS therefore stays off, deliberately and permanently.
+#
+# TWO defines, switched together in ONE place so they cannot drift:
+# MI_MALLOC_OVERRIDE reaches the mimalloc translation unit and turns the
+# override on; CBM_MEM_GLOBAL_OVERRIDE reaches OUR sources and tells the startup
+# audit what to expect. CBM_MEM_GLOBAL_OVERRIDE goes only into CFLAGS_PROD,
+# because MIMALLOC_CFLAGS_TEST compiles mimalloc with -DMI_OVERRIDE=0 and no
+# override define at all — a test binary has no global override BY CONSTRUCTION
+# and must never be told to expect one, or it warns on every run.
 MIMALLOC_OVERRIDE_DEFINE :=
-ifeq ($(IS_MINGW),yes)
+GLOBAL_OVERRIDE_DEFINE :=
+ifneq ($(filter yes,$(IS_MINGW) $(IS_LINUX)),)
 MIMALLOC_OVERRIDE_DEFINE := -DMI_MALLOC_OVERRIDE=1
+GLOBAL_OVERRIDE_DEFINE := -DCBM_MEM_GLOBAL_OVERRIDE=1
 endif
 MIMALLOC_CFLAGS = -std=c11 -O2 -w \
                   -Ivendored/mimalloc/include \

internal/cbm/zstd_store.c

@@ -7,12 +7,12 @@
 #include <stddef.h>
 #include <stdint.h>
 
-int cbm_zstd_compress(const char *src, int srcLen, char *dst, int dstCap, int level) {
-    size_t rc = ZSTD_compress(dst, (size_t)dstCap, src, (size_t)srcLen, level);
+int64_t cbm_zstd_compress(const char *src, size_t srcLen, char *dst, size_t dstCap, int level) {
+    size_t rc = ZSTD_compress(dst, dstCap, src, srcLen, level);
     if (ZSTD_isError(rc)) {
         return 0;
     }
-    return (int)rc;
+    return (int64_t)rc;
 }
 
 int64_t cbm_zstd_decompress(const char *src, size_t srcLen, char *dst, size_t dstCap) {
@@ -31,6 +31,6 @@ size_t cbm_zstd_frame_content_size(const char *src, size_t srcLen) {
     return (size_t)n;
 }
 
-size_t cbm_zstd_compress_bound(int inputSize) {
-    return ZSTD_compressBound((size_t)inputSize);
+size_t cbm_zstd_compress_bound(size_t inputSize) {
+    return ZSTD_compressBound(inputSize);
 }

internal/cbm/zstd_store.h

@@ -5,8 +5,10 @@
 #include <stdint.h>
 
 // Zstd compression at specified level (1=fast .. 22=best).
-// Returns compressed size on success, 0 on error.
-int cbm_zstd_compress(const char *src, int srcLen, char *dst, int dstCap, int level);
+// srcLen/dstCap are size_t for the same reason decompression's are: a >2 GiB
+// database would otherwise wrap through int and hand the encoder a capacity that
+// disagrees with the real buffer. Returns compressed size on success, 0 on error.
+int64_t cbm_zstd_compress(const char *src, size_t srcLen, char *dst, size_t dstCap, int level);
 
 // Zstd decompression. srcLen/dstCap are size_t so a >2 GiB destination capacity
 // is never truncated (a large DB artifact, or a crafted one, would otherwise
@@ -20,6 +22,6 @@ int64_t cbm_zstd_decompress(const char *src, size_t srcLen, char *dst, size_t ds
 size_t cbm_zstd_frame_content_size(const char *src, size_t srcLen);
 
 // Maximum compressed size bound for given input size.
-size_t cbm_zstd_compress_bound(int inputSize);
+size_t cbm_zstd_compress_bound(size_t inputSize);
 
 #endif // CBM_ZSTD_STORE_H

scripts/smoke-test.sh

@@ -187,6 +187,58 @@ if ! echo "$OUTPUT" | grep -qE 'v?[0-9]+\.[0-9]+|dev'; then
 fi
 echo "OK"
 
+echo ""
+echo "=== Phase 1b: allocator override matches this platform's contract ==="
+# Asserts the SHIPPED binary's actual allocator wiring, per platform:
+#
+#   Windows, Linux -> ordinary malloc MUST reach mimalloc (all size classes
+#                     owned). If it does not, every purge/reclaim option in
+#                     cbm_mem_init is decoration and freed pages stay committed
+#                     — that is #581, which hid in production for months
+#                     precisely because nothing asserted it on a real artifact.
+#   macOS          -> it MUST NOT. Enabling the override there aborts on the
+#                     first pointer crossing the two-level-namespace boundary
+#                     ("mi_free: invalid pointer"), so "owned" here would mean
+#                     we shipped a binary that crashes on index.
+#
+# Both directions fail. A silent flip either way is a release blocker, which is
+# why this lives in smoke (real artifact, all platforms) and not only in a unit
+# test built from source.
+ALLOC_LOG=$("$BINARY" cli list_projects 2>&1 >/dev/null || true)
+case "$(uname -s)" in
+  Darwin)
+    if echo "$ALLOC_LOG" | grep -q 'mem.allocator.not_owned'; then
+      echo "FAIL: macOS emitted the not_owned WARNING; expected the by-design"
+      echo "      bound-populations INFO line (see #1360)"
+      exit 1
+    fi
+    if echo "$ALLOC_LOG" | grep -q 'mem.allocator.owned'; then
+      echo "FAIL: macOS reports ordinary malloc as allocator-owned. The override"
+      echo "      must stay OFF here: under the two-level namespace it aborts"
+      echo "      with 'mi_free: invalid pointer' on the first crossing pointer."
+      exit 1
+    fi
+    echo "OK: macOS serves ordinary malloc from the system allocator, no warning"
+    ;;
+  MINGW*|MSYS*|CYGWIN*|Linux)
+    if echo "$ALLOC_LOG" | grep -q 'mem.allocator.not_owned'; then
+      echo "FAIL: ordinary malloc does NOT reach mimalloc on $(uname -s)."
+      echo "      Allocator tuning is inert and freed pages will stay committed (#581/#1360)."
+      echo "$ALLOC_LOG" | grep 'mem.allocator' | head -2
+      exit 1
+    fi
+    if echo "$ALLOC_LOG" | grep -q 'mem.allocator.bound_populations_only'; then
+      echo "FAIL: $(uname -s) reports bound-populations-only; the global override"
+      echo "      is expected to be compiled in on this platform (#1360)."
+      exit 1
+    fi
+    echo "OK: ordinary malloc reaches the allocator on $(uname -s)"
+    ;;
+  *)
+    echo "SKIP: no allocator contract defined for $(uname -s)"
+    ;;
+esac
+
 if [ "$SMOKE_MODE" != "--agent-config-only" ]; then
 echo ""
 echo "=== Phase 2: index test project ==="

src/cli/cli.c

@@ -5294,6 +5294,53 @@ static bool cbm_install_subagent_reminder_script(const char *home, const char *b
     return cbm_write_owned_hook_script_with_legacy(script_path, script, legacy, 1U);
 }
 
+/* #1387 dry-run predicate: would writing this hook script succeed, or would
+ * the owned-document migration refuse it because the file on disk is not ours?
+ * Read-only — it must never touch the filesystem, since a dry run promises
+ * exactly that. An unreadable/unsafe state counts as "would not succeed": the
+ * preview should warn rather than promise. */
+static bool cbm_hook_script_write_would_succeed(const char *home, const char *binary_path,
+                                                const char *script_name) {
+    if (!home || !binary_path || !script_name) {
+        return false;
+    }
+    char config_dir[CLI_BUF_1K];
+    cbm_claude_config_dir(home, config_dir, sizeof(config_dir));
+    if (!config_dir[0]) {
+        return false;
+    }
+    char script_path[CLI_BUF_1K];
+    int written =
+        snprintf(script_path, sizeof(script_path), "%s/hooks/%s", config_dir, script_name);
+    if (written <= 0 || (size_t)written >= sizeof(script_path)) {
+        return false;
+    }
+    const char *prefix = cmm_gate_script_prefix;
+    if (strcmp(script_name, CMM_SESSION_REMINDER_SCRIPT) == 0) {
+        prefix = cmm_session_script_prefix;
+    } else if (strcmp(script_name, CMM_SUBAGENT_REMINDER_SCRIPT) == 0) {
+        prefix = cmm_subagent_script_prefix;
+    }
+    char script[CLI_BUF_8K];
+    if (cbm_build_current_hook_script(prefix, binary_path, script, sizeof(script)) != CLI_OK) {
+        return false;
+    }
+    /* Released shapes are accepted by the real write, so they must be accepted
+     * here too or the preview would warn about a script that upgrades fine. */
+    char released[CLI_BUF_8K];
+    const char *candidates[2];
+    size_t candidate_count = 0U;
+    if (strcmp(script_name, CMM_HOOK_GATE_SCRIPT) == 0 &&
+        cbm_build_released_gate_script(binary_path, released, sizeof(released)) == CLI_OK) {
+        candidates[candidate_count++] = released;
+    } else if (strcmp(script_name, CMM_SESSION_REMINDER_SCRIPT) == 0) {
+        candidates[candidate_count++] = cmm_released_session_script;
+    } else if (strcmp(script_name, CMM_SUBAGENT_REMINDER_SCRIPT) == 0) {
+        candidates[candidate_count++] = cmm_released_subagent_script;
+    }
+    return cbm_text_owned_document_status(script_path, script, candidates, candidate_count) == 0;
+}
+
 int cbm_upsert_claude_subagent_hooks(const char *settings_path) {
     char command[CLI_BUF_8K];
     char previous_command[CLI_BUF_8K];
@@ -7195,6 +7242,18 @@ static void install_claude_code_config(const char *home, const char *binary_path
     bool gate_ok = dry_run;
     bool session_ok = dry_run;
     bool subagent_ok = dry_run;
+    if (dry_run) {
+        /* #1387 (second half): the dry run claimed EVERY hook group as
+         * installable because these flags were simply `true`. When the on-disk
+         * script is not ours the real install refuses to rewrite it, so the
+         * preview promised what the run could not deliver and the reporter had
+         * no way to see the loss coming. Predict each refusal read-only. */
+        gate_ok = cbm_hook_script_write_would_succeed(home, binary_path, CMM_HOOK_GATE_SCRIPT);
+        session_ok =
+            cbm_hook_script_write_would_succeed(home, binary_path, CMM_SESSION_REMINDER_SCRIPT);
+        subagent_ok =
+            cbm_hook_script_write_would_succeed(home, binary_path, CMM_SUBAGENT_REMINDER_SCRIPT);
+    }
     if (!dry_run) {
         char hook_path[CLI_BUF_1K];
         gate_ok = cbm_install_hook_gate_script(home, binary_path);
@@ -7241,6 +7300,22 @@ static void install_claude_code_config(const char *home, const char *binary_path
     if (subagent_ok) {
         printf("  hooks: SubagentStart (MCP usage reminder for subagents)\n");
     }
+    if (dry_run) {
+        /* Name every script the real run would refuse. Silence is what made
+         * #1387 invisible in advance: the group simply went unmentioned, which
+         * reads as "nothing to do" rather than "this will be skipped". */
+        static const char *const preview_scripts[] = {
+            CMM_HOOK_GATE_SCRIPT, CMM_SESSION_REMINDER_SCRIPT, CMM_SUBAGENT_REMINDER_SCRIPT};
+        const bool preview_ok[] = {gate_ok, session_ok, subagent_ok};
+        for (size_t i = 0U; i < sizeof(preview_scripts) / sizeof(preview_scripts[0]); i++) {
+            if (!preview_ok[i]) {
+                printf("  hooks: %s/hooks/%s would be skipped — the file there is not ours "
+                       "(modified, or written by another install), so the rewrite is refused "
+                       "and existing hook entries are left untouched\n",
+                       config_dir, preview_scripts[i]);
+            }
+        }
+    }
 
     /* Migration nudge: when CLAUDE_CONFIG_DIR is set and a legacy ~/.claude tree
      * still exists, mention it so users can clean up stale artifacts. */

src/cli/config_text_edit.c

@@ -1222,6 +1222,58 @@ static int text_matches_candidate(const char *data, size_t data_len, const char
     return TEXT_OK;
 }
 
+/* Read-only classification: WOULD a migrate of this document succeed?
+ * Returns TEXT_OK when the path is absent or already byte-identical to the
+ * current or an exact released document (a write would proceed), TEXT_UNOWNED
+ * when it holds other bytes (a write would be refused), TEXT_ERROR on unsafe
+ * state. Mirrors text_migrate_owned_document's decision WITHOUT writing, so
+ * `install --dry-run` can predict a refusal instead of promising an install it
+ * cannot deliver (#1387). */
+int cbm_text_owned_document_status(const char *file_path, const char *current_content,
+                                   const char *const *released_contents, size_t released_count) {
+    size_t current_len = 0U;
+    if (!text_valid_path(file_path) ||
+        text_bounded_strlen(current_content, TEXT_MAX_BYTES, &current_len) != TEXT_OK ||
+        text_validate_bytes(current_content, current_len, 1) != TEXT_OK ||
+        (released_count > 0U && !released_contents)) {
+        return TEXT_ERROR;
+    }
+
+    char *old_data = NULL;
+    size_t old_len = 0U;
+    text_file_snapshot_t snapshot;
+    if (text_read_file(file_path, &old_data, &old_len, &snapshot) != TEXT_OK ||
+        text_validate_bytes(old_data, old_len, 1) != TEXT_OK) {
+        free(old_data);
+        return TEXT_ERROR;
+    }
+    if (!snapshot.exists) {
+        free(old_data);
+        return TEXT_OK; /* absent -> the write creates it */
+    }
+    bool matches = false;
+    if (text_matches_candidate(old_data, old_len, current_content, &matches) != TEXT_OK) {
+        free(old_data);
+        return TEXT_ERROR;
+    }
+    if (matches) {
+        free(old_data);
+        return TEXT_OK;
+    }
+    for (size_t i = 0U; i < released_count; i++) {
+        if (text_matches_candidate(old_data, old_len, released_contents[i], &matches) != TEXT_OK) {
+            free(old_data);
+            return TEXT_ERROR;
+        }
+        if (matches) {
+            free(old_data);
+            return TEXT_OK; /* an exact released doc upgrades */
+        }
+    }
+    free(old_data);
+    return TEXT_UNOWNED;
+}
+
 static int text_migrate_owned_document(const char *file_path, const char *current_content,
                                        const char *const *released_contents, size_t released_count,
                                        int override_mode, unsigned int requested_mode) {

src/cli/config_text_edit.h

@@ -29,6 +29,11 @@ int cbm_text_ensure_owned_document(const char *file_path, const char *owned_cont
 /* Create current content, preserve it when already current, or atomically
  * upgrade only an exact byte-for-byte previously released document. Returns
  * 1 for user-modified/unowned content. */
+/* Read-only: would a migrate succeed? 0 = yes (absent/current/exact released),
+ * 1 = refused (other bytes present), -1 = unsafe. Lets `install --dry-run`
+ * predict a refusal instead of promising an install it cannot deliver. */
+int cbm_text_owned_document_status(const char *file_path, const char *current_content,
+                                   const char *const *released_contents, size_t released_count);
 int cbm_text_migrate_owned_document(const char *file_path, const char *current_content,
                                     const char *const *released_contents, size_t released_count);
 /* As above, but publish the owned document with the requested low permission

src/daemon/bootstrap.c

@@ -162,6 +162,10 @@ cbm_daemon_process_role_t cbm_daemon_process_role(int argc, char *const argv[])
         "install",
         "uninstall",
         "update",
+        /* allow-root writes one line of user-level config and reads nothing from a
+         * project, so it needs no daemon. Listed here rather than routed through
+         * the daemon so enrolling a root cannot depend on daemon state. */
+        "allow-root",
     };
     /* Stop at the first top-level mode token. Tool names, flag values, and JSON
      * following `cli` are opaque user input: a search query named "install"

src/daemon/version_cohort.c

@@ -457,6 +457,14 @@ cbm_version_cohort_status_t cbm_version_cohort_acquire(cbm_version_cohort_manage
                                           CBM_PRIVATE_FILE_LOCK_EX, &lease->lifetime);
     cbm_version_cohort_status_t status = version_cohort_status_from_lock(lock_status);
     if (status == CBM_VERSION_COHORT_OK) {
+        /* No live holder: this participant CLAIMS the cohort and NO identity
+         * comparison happens — a mismatched build is admitted, not refused.
+         * That is correct when nothing is running, and it is the only path by
+         * which a mismatched client can join. Name it: "was the lifetime lock
+         * held?" is exactly what separates a local run (conflict raised) from
+         * a CI run (client admitted), and it was not observable in any log. */
+        cbm_log_info("version_cohort.claimed_unheld", "build",
+                     identity->build_fingerprint ? identity->build_fingerprint : "<null>");
         status = version_cohort_claim_new(lease, identity, deadline_ms);
     } else if (status == CBM_VERSION_COHORT_BUSY) {
         lock_status =