From 5ca234c2b24c27a8a484e744cc200b93e01f130b Mon Sep 17 00:00:00 2001 From: LeoLan Digital Date: Tue, 25 Aug 2026 15:15:56 +0200 Subject: [PATCH 1/4] fix: persist daemon watches across client disconnects Signed-off-by: LeoLan Digital Signed-off-by: LeoLan Digital Signed-off-by: LeoLan Digital --- src/daemon/application.c | 65 ++++++++++++++------ tests/test_daemon_application.c | 102 ++++++++++++++++++++++++++++++++ 2 files changed, 150 insertions(+), 17 deletions(-) diff --git a/src/daemon/application.c b/src/daemon/application.c index 7e4a35be7e..ce0cfdaf85 100644 --- a/src/daemon/application.c +++ b/src/daemon/application.c @@ -149,11 +149,11 @@ struct cbm_daemon_application_job { cbm_daemon_application_job_t *next; }; -/* A watcher-triggered physical job is owned by the exact live sessions that - * currently subscribe to its project/root watch. The callback waiting for the - * job is only a storage waiter; it is deliberately not an ownership - * subscription, so the worker is cancelled when the last matching session - * disconnects even while unrelated daemon sessions remain alive. */ +/* A watcher-triggered physical job is normally owned by the exact live + * sessions subscribed to its project/root watch. In permanent daemon mode the + * watcher itself additionally owns the physical job so background indexing can + * continue while no client session is connected. The callback remains a + * storage waiter in both modes and releases daemon ownership on completion. */ struct cbm_daemon_application_watch_job_subscription { cbm_daemon_application_session_t *session; cbm_daemon_application_job_t *job; @@ -424,7 +424,19 @@ static void application_release_session_watch_locked(cbm_daemon_application_sess if (watch->subscribers > 0) { watch->subscribers--; } - if (watch->subscribers == 0) { + + /* + * A permanent daemon owns the physical project watch independently of + * individual client sessions. Session disconnect releases only that + * session's logical subscription; the watcher remains available for + * background change detection while the daemon generation is alive. + * + * Non-permanent applications retain the historical session-scoped + * lifecycle and remove the physical watch after the final subscriber. + * Project deletion/pruning and daemon shutdown remove persistent watches + * through their dedicated lifecycle paths. + */ + if (!session->application->permanent && watch->subscribers == 0) { application_remove_watch_locked(session->application, watch); } } @@ -3375,10 +3387,13 @@ static int application_background_index(cbm_daemon_application_t *application, cbm_mutex_lock(&application->mutex); cbm_daemon_application_watch_t *watch = require_live_watch ? application_find_watch_locked(application, project_name) : NULL; - bool watch_live = !require_live_watch || - (watch && watch->subscribers > 0 && strcmp(watch->root, canonical_root) == 0); + bool watch_live = + !require_live_watch || + (watch && strcmp(watch->root, canonical_root) == 0 && + (watch->subscribers > 0 || application->permanent)); size_t watch_owner_count = 0; bool watch_subscriptions_ok = true; + bool watcher_owns_job = false; cbm_daemon_application_job_t *job = watch_live ? application_job_subscribe_locked(application, project_key, canonical_root, args, &subscribe_status) @@ -3386,16 +3401,28 @@ static int application_background_index(cbm_daemon_application_t *application, if (job && require_live_watch) { watch_subscriptions_ok = application_watch_job_subscribe_sessions_locked( application, watch, job, &watch_owner_count); - if (watch_subscriptions_ok && watch_owner_count > 0) { - job->watcher_waiters++; - } else if (!watch_subscriptions_ok) { + + if (!watch_subscriptions_ok) { subscribe_status = APPLICATION_JOB_SUBSCRIBE_ALLOCATION_FAILED; - } - /* application_job_subscribe_locked() lends the caller one ordinary - * subscriber. A watcher callback is only a storage waiter: exact live - * session subscriptions above own the physical work. */ - application_job_unsubscribe_locked(job); - if (!watch_subscriptions_ok || watch_owner_count == 0) { + application_job_unsubscribe_locked(job); + job = NULL; + } else if (application->permanent) { + /* + * The ordinary subscription acquired above is retained as daemon + * ownership. This allows the physical watcher to run indexing even + * while no client session currently owns the project watch. + */ + watcher_owns_job = true; + job->watcher_waiters++; + } else if (watch_owner_count > 0) { + /* + * Historical non-permanent behavior: exact live sessions own the + * physical work; the watcher callback itself is only a waiter. + */ + job->watcher_waiters++; + application_job_unsubscribe_locked(job); + } else { + application_job_unsubscribe_locked(job); job = NULL; } } @@ -3428,6 +3455,10 @@ static int application_background_index(cbm_daemon_application_t *application, if (job->watcher_waiters > 0) { job->watcher_waiters--; } + if (watcher_owns_job) { + application_job_unsubscribe_locked(job); + watcher_owns_job = false; + } } else { application_job_unsubscribe_locked(job); } diff --git a/tests/test_daemon_application.c b/tests/test_daemon_application.c index c639ace2f7..b0b55e4f6b 100644 --- a/tests/test_daemon_application.c +++ b/tests/test_daemon_application.c @@ -3621,6 +3621,107 @@ TEST(daemon_application_watcher_job_follows_exact_live_watch_owners) { PASS(); } + +TEST(daemon_application_permanent_watch_survives_disconnect_and_indexes_without_session) { + app_watch_race_fixture_t fixture; + bool fixture_ready = app_watch_race_fixture_init(&fixture, 47); + + if (fixture_ready) { + cbm_daemon_application_set_permanent(fixture.application, true); + } + + int watch_before_disconnect = + fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + if (fixture.session) { + fixture.callbacks.session_cancel(fixture.callbacks.context, fixture.session); + } + + int watch_after_cancel = + fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + if (fixture.session) { + fixture.callbacks.session_close(fixture.callbacks.context, fixture.session); + fixture.session = NULL; + } + + int watch_after_close = + fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + /* + * No client session remains at this point. A permanent daemon-owned + * physical watch must nevertheless be allowed to launch its background + * indexing job. + */ + app_watcher_index_thread_t request = { + .application = fixture.application, + .project = fixture.project, + .root = fixture.root, + .pause_before_subscribe = false, + .result = -1, + }; + atomic_init(&request.ready, false); + atomic_init(&request.proceed, true); + atomic_init(&request.done, false); + + cbm_thread_t thread; + bool thread_started = + fixture_ready && + watch_after_close == 1 && + cbm_thread_create(&thread, 0, app_watcher_index_thread, &request) == 0; + + bool worker_started = + thread_started && app_wait_for_atomic_int(&fixture.fake.starts, 1); + + int watch_during_job = + fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + /* + * The fake worker deliberately waits until the test releases it. + * Let the daemon-owned watcher job finish normally. + */ + if (worker_started) { + atomic_store(&fixture.fake.allow_completion, true); + } + + bool request_done = + thread_started && app_wait_for_atomic_bool(&request.done, true); + + bool thread_joined = + request_done && cbm_thread_join(&thread) == 0; + + int watch_after_job = + fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + int destroys_before_cleanup = + fixture_ready ? atomic_load(&fixture.fake.destroys) : -1; + + bool cleaned = app_watch_race_fixture_finish(&fixture); + + ASSERT_TRUE(fixture_ready); + ASSERT_EQ(watch_before_disconnect, 1); + + /* Permanent mode: disconnect must not unwatch the project. */ + ASSERT_EQ(watch_after_cancel, 1); + ASSERT_EQ(watch_after_close, 1); + + /* No session exists, yet the watcher still owns background indexing. */ + ASSERT_TRUE(thread_started); + ASSERT_TRUE(worker_started); + ASSERT_EQ(watch_during_job, 1); + + ASSERT_TRUE(request_done); + ASSERT_TRUE(thread_joined); + ASSERT_EQ(request.result, 0); + ASSERT_EQ(destroys_before_cleanup, 1); + + /* Completing the background job must not consume the persistent watch. */ + ASSERT_EQ(watch_after_job, 1); + + ASSERT_TRUE(cleaned); + PASS(); +} + TEST(daemon_application_late_watcher_session_owns_active_watcher_job) { app_watch_race_fixture_t fixture; bool fixture_ready = app_watch_race_fixture_init(&fixture, 45); @@ -5116,6 +5217,7 @@ SUITE(daemon_application) { RUN_TEST(daemon_application_stale_watcher_callback_is_rejected_at_job_admission); RUN_TEST(daemon_application_final_cancel_drains_admitted_watcher_job); RUN_TEST(daemon_application_watcher_job_follows_exact_live_watch_owners); + RUN_TEST(daemon_application_permanent_watch_survives_disconnect_and_indexes_without_session); RUN_TEST(daemon_application_late_watcher_session_owns_active_watcher_job); RUN_TEST(daemon_application_serializes_adr_mutation_with_index_job); RUN_TEST(daemon_application_reserved_mutation_delays_worker_start); From 74e301d42e8a5ab32aa31d46e21637fd9d241a6f Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 28 Oct 2026 00:45:27 +0100 Subject: [PATCH 2/4] fix(daemon): end a permanent watch whose project was deleted Under `daemon start` a watch now outlives its last session. delete_project from another session or the CLI removes the project's DB but meets no owner of the watch: daemon MCP sessions carry no watcher pointer, so nothing unwatches it, and the next change in that root re-indexed the deleted project. When a permanent watch has no subscribers, no job for its project is running and its DB is gone, the watcher callback now removes the watch and skips, the rule a session refresh already applies to a deleted project. The running-job guard is needed because a full reindex unlinks the DB while it rebuilds it: a second change during that rebuild must join the job, not end the watch. Session-owned watches are unchanged. Tests: daemon_application_permanent_watch_ends_when_project_db_is_deleted (RED before: the deleted project was re-indexed) and daemon_application_permanent_watch_kept_while_its_reindex_runs (RED without the running-job guard: the second change ended the watch). Signed-off-by: Martin Vogel --- src/daemon/application.c | 21 +++++ tests/test_daemon_application.c | 147 ++++++++++++++++++++++++++++++++ 2 files changed, 168 insertions(+) diff --git a/src/daemon/application.c b/src/daemon/application.c index a4e8f8fd1f..804614e699 100644 --- a/src/daemon/application.c +++ b/src/daemon/application.c @@ -4268,6 +4268,21 @@ static void application_watch_encode_index_args_locked(const cbm_daemon_applicat *args = encoded ? yyjson_mut_write(document, 0, NULL) : NULL; } +/* Under `daemon start` a watch outlives its last session, so delete_project + * from another session or the CLI can remove the project's DB while nothing + * owns the watch any more: daemon MCP sessions carry no watcher pointer and + * never unwatch it. Re-indexing such an orphan would resurrect the deleted + * project. A full reindex also unlinks the DB while it rebuilds it, so a + * missing DB means "deleted" only while no job for the project is running. + * Caller holds application->mutex. */ +static bool application_permanent_watch_orphaned_locked(cbm_daemon_application_t *application, + const cbm_daemon_application_watch_t *watch, + const char *project_key) { + return application->permanent && watch->subscribers == 0 && + !application_find_active_job_locked(application, project_key) && + !application_regular_db_exists(watch->project); +} + static cbm_daemon_application_job_t *application_background_index_admit( cbm_daemon_application_t *application, const char *project_name, const char *canonical_root, const char *project_key, yyjson_mut_doc *document, yyjson_mut_val *root, char **args, @@ -4281,6 +4296,12 @@ static cbm_daemon_application_job_t *application_background_index_admit( } cbm_daemon_application_watch_t *watch = require_live_watch ? application_find_watch_locked(application, project_name) : NULL; + if (watch && application_permanent_watch_orphaned_locked(application, watch, project_key)) { + /* End the orphan the way a session refresh ends a deleted project's + * watch; the callback below becomes a harmless skip. */ + application_remove_watch_locked(application, watch); + watch = NULL; + } bool watch_live = !require_live_watch || (watch && application_watch_root_matches(watch->root, canonical_root) && (watch->subscribers > 0 || application->permanent)); diff --git a/tests/test_daemon_application.c b/tests/test_daemon_application.c index 67de9002fe..b4c0d23160 100644 --- a/tests/test_daemon_application.c +++ b/tests/test_daemon_application.c @@ -4687,6 +4687,151 @@ TEST(daemon_application_permanent_watch_survives_disconnect_and_indexes_without_ PASS(); } +/* A permanent daemon keeps a project watched after its last session closes. + * delete_project from another session or the CLI removes the project's DB but + * owns no watch, so the watch itself must notice: a later change must end the + * orphaned watch, never re-create the deleted index. */ +TEST(daemon_application_permanent_watch_ends_when_project_db_is_deleted) { + app_watch_race_fixture_t fixture; + bool fixture_ready = app_watch_race_fixture_init(&fixture, 48); + if (fixture_ready) { + cbm_daemon_application_set_permanent(fixture.application, true); + /* Should a job be admitted, it completes at once: the verdict is + * read from the start counter, never from a timeout. */ + atomic_store(&fixture.fake.allow_completion, true); + } + if (fixture.session) { + fixture.callbacks.session_cancel(fixture.callbacks.context, fixture.session); + fixture.callbacks.session_close(fixture.callbacks.context, fixture.session); + fixture.session = NULL; + } + int watch_after_close = fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + bool db_removed = fixture_ready && cbm_unlink(fixture.db_path) == 0; + int result = db_removed ? cbm_daemon_application_watcher_index(fixture.project, fixture.root, + fixture.application) + : -2; + int starts = fixture_ready ? atomic_load(&fixture.fake.starts) : -1; + int watch_after_index = fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + bool cleaned = app_watch_race_fixture_finish(&fixture); + + ASSERT_TRUE(fixture_ready); + ASSERT_EQ(watch_after_close, 1); + ASSERT_TRUE(db_removed); + /* A harmless skip: nothing admitted, the deleted index stays deleted. */ + ASSERT_EQ(result, 1); + ASSERT_EQ(starts, 0); + /* The orphaned physical watch is torn down. */ + ASSERT_EQ(watch_after_index, 0); + ASSERT_TRUE(cleaned); + PASS(); +} + +/* The second watcher callback either joins the running job (its retained + * ownership is the job's second subscriber) or returns. Both states latch, so + * whichever happens decides the wait; the deadline only catches "neither". */ +static bool app_wait_for_watcher_join_or_return(cbm_daemon_application_t *application, + const char *project, atomic_bool *returned) { + uint64_t deadline = cbm_now_ms() + APP_TEST_TIMEOUT_MS; + while (cbm_now_ms() < deadline) { + if (cbm_daemon_application_job_subscribers(application, project) == 2 || + atomic_load(returned)) { + return true; + } + cbm_usleep(1000); + } + return false; +} + +/* A full reindex unlinks the project's DB while it rebuilds it, so a missing + * DB alone does not mean the project was deleted. While the permanent watch's + * own job runs, a second change in its root must join that job and keep the + * watch; once the job ends, both callbacks hand their ownership back. */ +TEST(daemon_application_permanent_watch_kept_while_its_reindex_runs) { + app_watch_race_fixture_t fixture; + bool fixture_ready = app_watch_race_fixture_init(&fixture, 49); + if (fixture_ready) { + cbm_daemon_application_set_permanent(fixture.application, true); + } + if (fixture.session) { + fixture.callbacks.session_cancel(fixture.callbacks.context, fixture.session); + fixture.callbacks.session_close(fixture.callbacks.context, fixture.session); + fixture.session = NULL; + } + int watch_after_close = fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + app_watcher_index_thread_t first = { + .application = fixture.application, + .project = fixture.project, + .root = fixture.root, + .pause_before_subscribe = false, + .result = -1, + }; + atomic_init(&first.ready, false); + atomic_init(&first.proceed, true); + atomic_init(&first.done, false); + app_watcher_index_thread_t second = { + .application = fixture.application, + .project = fixture.project, + .root = fixture.root, + .pause_before_subscribe = false, + .result = -1, + }; + atomic_init(&second.ready, false); + atomic_init(&second.proceed, true); + atomic_init(&second.done, false); + + /* The fake worker keeps the first job running until allow_completion. */ + cbm_thread_t first_thread; + bool first_started = fixture_ready && watch_after_close == 1 && + cbm_thread_create(&first_thread, 0, app_watcher_index_thread, &first) == 0; + bool job_running = first_started && app_wait_for_atomic_int(&fixture.fake.starts, 1); + bool db_removed = job_running && cbm_unlink(fixture.db_path) == 0; + cbm_thread_t second_thread; + bool second_started = + db_removed && cbm_thread_create(&second_thread, 0, app_watcher_index_thread, &second) == 0; + bool settled = second_started && app_wait_for_watcher_join_or_return( + fixture.application, fixture.project, &second.done); + size_t subscribers_while_running = + fixture_ready ? cbm_daemon_application_job_subscribers(fixture.application, fixture.project) + : 0; + bool second_returned_while_running = atomic_load(&second.done); + int watch_while_running = fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + + if (fixture_ready) { + atomic_store(&fixture.fake.allow_completion, true); + } + bool first_joined = first_started && app_wait_for_atomic_bool(&first.done, true) && + cbm_thread_join(&first_thread) == 0; + bool second_joined = second_started && app_wait_for_atomic_bool(&second.done, true) && + cbm_thread_join(&second_thread) == 0; + int starts = fixture_ready ? atomic_load(&fixture.fake.starts) : -1; + size_t subscribers_after = + fixture_ready ? cbm_daemon_application_job_subscribers(fixture.application, fixture.project) + : SIZE_MAX; + int watch_after = fixture_ready ? cbm_watcher_watch_count(fixture.watcher) : -1; + bool cleaned = app_watch_race_fixture_finish(&fixture); + + ASSERT_TRUE(fixture_ready); + ASSERT_EQ(watch_after_close, 1); + ASSERT_TRUE(job_running); + ASSERT_TRUE(db_removed); + ASSERT_TRUE(settled); + /* The second change joined the running job instead of ending the watch. */ + ASSERT_EQ(subscribers_while_running, 2); + ASSERT_FALSE(second_returned_while_running); + ASSERT_EQ(watch_while_running, 1); + ASSERT_TRUE(first_joined); + ASSERT_TRUE(second_joined); + ASSERT_EQ(first.result, 0); + ASSERT_EQ(second.result, 0); + ASSERT_EQ(starts, 1); + /* Each callback released the ownership it retained at admission. */ + ASSERT_EQ(subscribers_after, 0); + ASSERT_EQ(watch_after, 1); + ASSERT_TRUE(cleaned); + PASS(); +} + TEST(daemon_application_late_watcher_session_owns_active_watcher_job) { app_watch_race_fixture_t fixture; bool fixture_ready = app_watch_race_fixture_init(&fixture, 45); @@ -7793,6 +7938,8 @@ SUITE(daemon_application) { RUN_TEST(daemon_application_final_cancel_drains_admitted_watcher_job); RUN_TEST(daemon_application_watcher_job_follows_exact_live_watch_owners); RUN_TEST(daemon_application_permanent_watch_survives_disconnect_and_indexes_without_session); + RUN_TEST(daemon_application_permanent_watch_ends_when_project_db_is_deleted); + RUN_TEST(daemon_application_permanent_watch_kept_while_its_reindex_runs); RUN_TEST(daemon_application_late_watcher_session_owns_active_watcher_job); RUN_TEST(daemon_application_watch_roots_match_windows_separators_only); RUN_TEST(daemon_application_async_completion_disables_all_watches); From 631418683e005850a3bce49a81f2cf655ce53e1c Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 28 Oct 2026 00:50:51 +0100 Subject: [PATCH 3/4] fix(daemon): keep the workspace-policy release under daemon start Under `daemon start` the session watch release kept every watch whose last subscriber left, so the daemon could keep watching after the session ended. The same release also runs when a session's root stops being allowed by workspace policy (an approval revoked, a boundary declared). That is not a disconnect: the session is still open and its root is refused, so keeping the watch there let a permanent daemon go on indexing a root the user had just withdrawn. application_release_session_watch_locked() now takes session_ending. The cancel and close paths pass true and keep the daemon-owned watch exactly as before; the workspace-policy branch of the watch refresh passes false and removes the watch in both modes, as it did before permanent watches. Test: daemon_application_permanent_workspace_release_still_ends_watch revokes the sensitive-root approval of a permanent session's root and sends one request; its synchronous refresh must end the watch (RED when the policy branch passes true). Signed-off-by: Martin Vogel --- src/daemon/application.c | 20 ++++-- tests/test_daemon_application.c | 117 ++++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+), 7 deletions(-) diff --git a/src/daemon/application.c b/src/daemon/application.c index 804614e699..2383b03590 100644 --- a/src/daemon/application.c +++ b/src/daemon/application.c @@ -564,7 +564,8 @@ static bool application_watches_disabled_locked(cbm_daemon_application_t *applic return true; } -static void application_release_session_watch_locked(cbm_daemon_application_session_t *session) { +static void application_release_session_watch_locked(cbm_daemon_application_session_t *session, + bool session_ending) { application_watch_job_unsubscribe_session_locked(session, NULL); /* @@ -575,9 +576,14 @@ static void application_release_session_watch_locked(cbm_daemon_application_sess * * Non-permanent applications retain the historical session-scoped * lifecycle and remove the physical watch after the final subscriber. - * Project deletion/pruning and daemon shutdown remove persistent watches - * through their dedicated lifecycle paths. + * A release decided by workspace policy (session_ending false: the + * session's root is no longer allowed) is not a disconnect and removes + * the watch in both modes. Daemon shutdown and auto_watch=false remove + * persistent watches through their own paths; a deleted project's watch + * ends at its next watcher callback + * (application_permanent_watch_orphaned_locked). */ + bool daemon_keeps_watch = session_ending && session->application->permanent; while (session->watches) { application_watch_membership_t *membership = session->watches; cbm_daemon_application_watch_t *watch = membership->watch; @@ -585,7 +591,7 @@ static void application_release_session_watch_locked(cbm_daemon_application_sess cbm_free(CBM_MEM_CLASS_OTHER, membership); if (watch->subscribers > 0) { watch->subscribers--; - if (!session->application->permanent && watch->subscribers == 0) { + if (!daemon_keeps_watch && watch->subscribers == 0) { application_remove_watch_locked(session->application, watch); } } @@ -733,7 +739,7 @@ static void application_refresh_watch_locked(cbm_daemon_application_session_t *s return; } if (!application_session_workspace_allowed(session, "watch")) { - application_release_session_watch_locked(session); + application_release_session_watch_locked(session, false); return; } application_register_watch_locked(session, cbm_mcp_server_session_project(session->mcp), @@ -3661,7 +3667,7 @@ static void application_session_cancel(void *context, reap_update || (session->background_eligible && application->update_thread_started && application->update_owners == 0); application_index_watch_unsubscribe_locked(session, NULL); - application_release_session_watch_locked(session); + application_release_session_watch_locked(session, true); bool final_live_session = newly_cancelled; for (cbm_daemon_application_session_t *other = application->sessions; final_live_session && other; other = other->next) { @@ -3721,7 +3727,7 @@ static void application_session_close(void *context, reap_update || (session->background_eligible && application->update_thread_started && application->update_owners == 0); application_index_watch_unsubscribe_locked(session, NULL); - application_release_session_watch_locked(session); + application_release_session_watch_locked(session, true); cbm_mutex_unlock(&application->mutex); application_auto_index_cancel_join(application, join_auto_index); application_jobs_reap_completed(application); diff --git a/tests/test_daemon_application.c b/tests/test_daemon_application.c index b4c0d23160..6b8e91d9fd 100644 --- a/tests/test_daemon_application.c +++ b/tests/test_daemon_application.c @@ -2820,6 +2820,122 @@ TEST(daemon_application_sensitive_root_blocks_watch_but_preserves_controls) { PASS(); } +/* Under `daemon start` a session that ENDS leaves its watch to the daemon, but + * a workspace-policy release is not a disconnect: once the session's root is + * no longer allowed (here its approval is revoked), the next request's + * refresh must still end the watch in a permanent generation too. */ +TEST(daemon_application_permanent_workspace_release_still_ends_watch) { + app_env_backup_t cache_environment; + app_env_backup_t home_environment; + bool environments_saved = app_env_backup_capture(&cache_environment, "CBM_CACHE_DIR") && + app_env_backup_capture(&home_environment, "HOME"); + char sensitive_raw[APP_TEST_PATH_CAP]; + char cache_raw[APP_TEST_PATH_CAP]; + (void)snprintf(sensitive_raw, sizeof(sensitive_raw), + "%s/cbm-app-permanent-release-home-XXXXXX", cbm_tmpdir()); + (void)snprintf(cache_raw, sizeof(cache_raw), "%s/cbm-app-permanent-release-cache-XXXXXX", + cbm_tmpdir()); + bool dirs_ok = cbm_mkdtemp(sensitive_raw) != NULL && cbm_mkdtemp(cache_raw) != NULL; + char sensitive[APP_TEST_PATH_CAP] = {0}; + char cache[APP_TEST_PATH_CAP] = {0}; + bool canonical = dirs_ok && cbm_canonical_path(sensitive_raw, sensitive, sizeof(sensitive)) && + cbm_canonical_path(cache_raw, cache, sizeof(cache)); + bool environments_set = environments_saved && canonical && + cbm_setenv("CBM_CACHE_DIR", cache, 1) == 0 && + cbm_setenv("HOME", sensitive, 1) == 0; + cbm_config_t *stored_config = environments_set ? cbm_config_open(cache) : NULL; + bool config_ready = stored_config && + cbm_config_set(stored_config, CBM_CONFIG_AUTO_INDEX, "false") == 0 && + cbm_config_set(stored_config, CBM_CONFIG_AUTO_WATCH, "true") == 0; + char *project = canonical ? cbm_project_name_from_path(sensitive) : NULL; + char db_path[APP_TEST_PATH_CAP] = {0}; + if (project) { + (void)snprintf(db_path, sizeof(db_path), "%s/%s.db", cache, project); + } + bool db_ready = config_ready && project && app_test_create_empty_file(db_path); + /* The root is $HOME, so only an explicit sensitive approval allows it. */ + char grant_error[APP_TEST_PATH_CAP]; + bool approved = db_ready && cbm_workspace_grant_add(cache, sensitive, sensitive, true, + grant_error, sizeof(grant_error)); + char grant_path[APP_TEST_PATH_CAP] = {0}; + bool grant_path_ok = + approved && cbm_workspace_grant_path(cache, grant_path, sizeof(grant_path)); + + cbm_store_t *store = cbm_store_open_memory(); + cbm_watcher_t *watcher = cbm_watcher_new(store, app_test_index_noop, NULL); + cbm_daemon_application_config_t config = { + .watcher = watcher, + .config = stored_config, + }; + cbm_daemon_application_t *application = + grant_path_ok && watcher ? cbm_daemon_application_new(&config) : NULL; + if (application) { + cbm_daemon_application_set_permanent(application, true); + } + cbm_daemon_runtime_application_callbacks_t callbacks = + cbm_daemon_application_runtime_callbacks(application); + cbm_daemon_runtime_application_session_t *session = + application ? app_test_open(&callbacks, 4036) : NULL; + + bool initialized = app_test_initialize_profile(&callbacks, session, sensitive, + CBM_MCP_TOOL_PROFILE_ALL, NULL, NULL); + int watch_while_approved = watcher ? cbm_watcher_watch_count(watcher) : -1; + + /* Revoke the approval. Every request ends with a synchronous watch + * refresh, so one ping is the point where the policy is re-read. */ + bool revoked = initialized && cbm_unlink(grant_path) == 0; + uint8_t *ping = NULL; + uint32_t ping_length = 0; + uint8_t *response = NULL; + uint32_t response_length = 0; + bool pinged = revoked && + app_test_text_request(CBM_DAEMON_APPLICATION_REQUEST_MCP, + "{\"jsonrpc\":\"2.0\",\"id\":4136,\"method\":\"ping\"}", + &ping, &ping_length) && + app_test_request(&callbacks, session, ping, ping_length, &response, + &response_length) == CBM_DAEMON_RUNTIME_APPLICATION_OK; + free(response); + free(ping); + int watch_after_revoke = watcher ? cbm_watcher_watch_count(watcher) : -1; + + if (session) { + callbacks.session_cancel(callbacks.context, session); + callbacks.session_close(callbacks.context, session); + } + bool stopped = application && cbm_daemon_application_shutdown(application, APP_TEST_TIMEOUT_MS); + cbm_daemon_application_free(application); + if (watcher) { + cbm_watcher_stop(watcher); + cbm_watcher_free(watcher); + } + cbm_store_close(store); + cbm_config_close(stored_config); + free(project); + (void)th_rmtree(sensitive); + (void)th_rmtree(cache); + bool cache_restored = app_env_backup_restore(&cache_environment); + bool home_restored = app_env_backup_restore(&home_environment); + + ASSERT_TRUE(environments_saved); + ASSERT_TRUE(dirs_ok); + ASSERT_TRUE(canonical); + ASSERT_TRUE(environments_set); + ASSERT_TRUE(config_ready); + ASSERT_TRUE(db_ready); + ASSERT_TRUE(approved); + ASSERT_TRUE(grant_path_ok); + ASSERT_TRUE(initialized); + ASSERT_EQ(watch_while_approved, 1); + ASSERT_TRUE(revoked); + ASSERT_TRUE(pinged); + /* A policy release, not a disconnect: the permanent watch ends as well. */ + ASSERT_EQ(watch_after_revoke, 0); + ASSERT_TRUE(stopped); + ASSERT_TRUE(cache_restored); + ASSERT_TRUE(home_restored); + PASS(); +} + TEST(daemon_application_programmatic_index_injects_resource_policy) { char *root = th_mktempdir("cbm_app_policy_root"); char *cache = th_mktempdir("cbm_app_policy_cache"); @@ -7904,6 +8020,7 @@ SUITE(daemon_application) { RUN_TEST(daemon_application_initialize_coalesces_auto_index_for_full_sessions); RUN_TEST(daemon_application_sensitive_root_blocks_auto_index_but_preserves_controls); RUN_TEST(daemon_application_sensitive_root_blocks_watch_but_preserves_controls); + RUN_TEST(daemon_application_permanent_workspace_release_still_ends_watch); RUN_TEST(daemon_application_ui_index_accepts_non_ascii_directory); RUN_TEST(daemon_application_index_args_compare_repo_path_separator_equivalently); RUN_TEST(daemon_application_async_index_returns_before_completion_and_status_polls); From 70d6d5017c741b57cd035b1ecc7927affb7908a2 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Wed, 28 Oct 2026 00:51:48 +0100 Subject: [PATCH 4/4] docs(watcher): describe the watch lifetime under daemon start A daemon started with `daemon start` now keeps a project watched after its last owning MCP session closes, until the daemon stops, the project is deleted, its directory disappears, or auto_watch is set to false. README (the watcher paragraph and the index_repository row), the watcher_enabled row of docs/CONFIGURATION.md and the comment above the index_status watch provider still said every watch ends with its last session. Signed-off-by: Martin Vogel --- README.md | 4 ++-- docs/CONFIGURATION.md | 2 +- src/daemon/application.c | 4 +++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8fd5c68a99..4162ae3710 100644 --- a/README.md +++ b/README.md @@ -255,7 +255,7 @@ codebase-memory-mcp config set auto_index true `auto_index` is off by default. When enabled, new projects are indexed automatically on first connection. The configurable file limit is `config set auto_index_limit 50000`. Previously indexed projects can be watched through `auto_watch` (on by default), subject to its global setting and session ownership. -Each initialized, long-lived MCP session can register its root project when it connects and any target from a successful `index_repository` call, including custom project names and roots in another worktree. While `auto_watch` is enabled, these watches belong to the registering sessions and remain while at least one owning session is connected; closing the last owner removes the watch. An async index registers its target only after success and while its requesting session remains connected. CLI indexing and failed MCP indexes do not register watches. Global `auto_watch` controls registration and removes all watches on the next refresh or registration request when set to `false`. `index_status` reports this in its `watch` object: `watched`, and either the poll cadence and last scan time or the `reason` it is not watched. +Each initialized, long-lived MCP session can register its root project when it connects and any target from a successful `index_repository` call, including custom project names and roots in another worktree. While `auto_watch` is enabled, these watches belong to the registering sessions and remain while at least one owning session is connected; closing the last owner removes the watch. Under a daemon started with `daemon start` a watch outlives its last owning session: the project stays watched and is re-indexed in the background when it changes, until that daemon stops, the project is deleted, its directory disappears, or `auto_watch` is set to `false`. An async index registers its target only after success and while its requesting session remains connected. CLI indexing and failed MCP indexes do not register watches. Global `auto_watch` controls registration and removes all watches on the next refresh or registration request when set to `false`. `index_status` reports this in its `watch` object: `watched`, and either the poll cadence and last scan time or the `reason` it is not watched. Watcher registration is controlled globally by `auto_watch` (default `true`). On the next refresh or registration request, `true` allows MCP sessions to register their root on connect and their successful `index_repository` targets; `false` removes all watches. CLI indexing and failed MCP indexes do not add watches. @@ -877,7 +877,7 @@ Tools requiring arguments accept JSON piped on stdin. Tools with only optional a | Tool | Description | |------|-------------| -| `index_repository` | Index a repository into the graph. A successful call from an active MCP session registers the target for auto-sync while that session remains connected, subject to the global `auto_watch` setting; CLI calls do not register watches. Waits for the whole index by default; pass `async: true` to start it in the daemon and return at once, then poll with `status: true` (see below). | +| `index_repository` | Index a repository into the graph. A successful call from an active MCP session registers the target for auto-sync while that session remains connected (under `daemon start`, also after it disconnects), subject to the global `auto_watch` setting; CLI calls do not register watches. Waits for the whole index by default; pass `async: true` to start it in the daemon and return at once, then poll with `status: true` (see below). | | `list_projects` | List indexed projects with paging; use `detail: "stats"` for node/edge counts and database sizes. | | `delete_project` | Remove a project and all its graph data. | | `index_status` | Check indexing status of a project. | diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md index 0981f6fc20..96a8237520 100644 --- a/docs/CONFIGURATION.md +++ b/docs/CONFIGURATION.md @@ -89,7 +89,7 @@ Current keys: | `auto_index_limit` | `50000` | Maximum file count allowed for automatic indexing of a new project. | | `auto_watch` | `true` | Global switch for MCP session watch registration. On the next refresh or registration request, `true` allows session roots and successful `index_repository` targets to be watched; `false` removes all watches. The background watcher can still run with no registered projects. | | `doc_candidates` | `auto` | Score documentation sections against code to store doc↔code candidates (the possible targets of a section, and the sections that may describe a function or file, each with a judged probability). Unset (`auto`), the index mode decides: on for `full` indexes (the default mode), off for `moderate` and `fast`. Set `true` or `false` to choose for every mode; `config reset doc_candidates` returns to `auto`. The scoring grows with sections × functions: under a second up to ~100k functions, ~15 s at ~400k, ~3 minutes on the Linux kernel. Off stores no candidates and leaves the rest of the graph unchanged; on in `fast` mode stores candidates without adding `fast`'s skipped `SIMILAR_TO` / `SEMANTICALLY_RELATED` edges. `index_repository` also takes `doc_candidates` for a single index, which wins over this setting. Applies from the next index. | -| `watcher_enabled` | `true` | Master switch for the background watcher subsystem. Set `false` to stop the watcher from starting at all — no poll thread and no project registration. Reindex manually with `index_repository` when disabled. Active MCP sessions can register their root project and successful explicit index targets; `index_status` reports the current state in its `watch` object. | +| `watcher_enabled` | `true` | Master switch for the background watcher subsystem. Set `false` to stop the watcher from starting at all — no poll thread and no project registration. Reindex manually with `index_repository` when disabled. Active MCP sessions can register their root project and successful explicit index targets; under `daemon start` those watches outlive the session until the daemon stops, the project is deleted, its directory disappears, or `auto_watch` is set to `false`. `index_status` reports the current state in its `watch` object. | | `watch_non_git` | `false` | Also poll project roots that are **not git repositories**. By default the watcher only follows git projects, so a project indexed from a plain directory is never refreshed after its first index — reindex it manually with `index_repository`. Set `true` to poll such roots on the same adaptive cadence with a file-tree scan: the indexer's own discovery walk (same skip lists, `.gitignore` and `.cbmignore` rules) hashed over each file's path, size and mtime. Any change reindexes once; paths the indexer skips (including cbm's own `.codebase-memory/` output) never trigger. The first poll after the daemon starts reindexes each such project once, since nothing records which tree state the index holds. The scan walks the whole tree every poll, so it costs more than git polling on very large trees. Read once when the daemon starts, like `watcher_enabled`. | | `index_max_files` | `off` | Optional maximum number of accepted source files in one discovery run. | | `index_max_source_mb` | `off` | Optional maximum accepted source size in MiB in one discovery run. | diff --git a/src/daemon/application.c b/src/daemon/application.c index 2383b03590..eb9bf97f4d 100644 --- a/src/daemon/application.c +++ b/src/daemon/application.c @@ -824,7 +824,9 @@ static const char *application_watch_strategy_name(cbm_watcher_strategy_t strate /* index_status watch visibility (#2167). The physical watcher is the truth for * "watched"; session roots and successful explicit targets stay watched while - * at least one owning MCP session remains open. Takes the + * at least one owning MCP session remains open (under `daemon start`, also + * after the last one closes, until the daemon stops, the project is deleted, + * its root disappears, or auto_watch is switched off). Takes the * application mutex and the watcher lock one after the other, never nested. */ static void application_watch_status(void *context, const char *project, cbm_mcp_watch_status_t *out) {