Merge pull request #28 from Litenova-Solutions/release/v4.2

Release v4.2.0: daemon-owned single-writer index, operational-error taxonomy, performance milestone (R42-R50)

Author: litenova

.github/workflows/ci-sdk.yml

@@ -0,0 +1,47 @@
+name: CI SDK
+
+# RequiresSdk integration tests need a working .NET SDK and the bundled build-capture worker.
+# They are excluded from the default CI leg (Category!=RequiresSdk) for fast feedback.
+
+on:
+  pull_request:
+    branches: [main, master]
+  push:
+    branches: [main, master]
+
+jobs:
+  sdk-tests:
+    name: RequiresSdk tests (${{ matrix.rid }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest
+            rid: win-x64
+          - os: ubuntu-latest
+            rid: linux-x64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Install Linux publish prerequisites
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang zlib1g-dev
+
+      - name: Restore
+        run: dotnet restore Fuse.slnx
+
+      - name: Build
+        run: dotnet build Fuse.slnx --configuration Release --no-restore
+
+      - name: Test RequiresSdk
+        run: dotnet test Fuse.slnx --configuration Release --no-build --verbosity normal --filter "Category=RequiresSdk"

.github/workflows/ci.yml

@@ -24,6 +24,14 @@ jobs:
         shell: pwsh
         run: ./build/verify-version.ps1
 
+      - name: Verify RequiresSdk CI legs
+        shell: pwsh
+        run: ./build/verify-ci-sdk.ps1
+
+      - name: Verify briefing drift guard
+        shell: pwsh
+        run: ./build/verify-briefing.ps1
+
       - name: Validate MCP registry manifest
         shell: pwsh
         run: |
@@ -83,7 +91,7 @@ jobs:
         run: dotnet tool install --global dotnet-coverage
 
       - name: Test with coverage
-        run: dotnet-coverage collect "dotnet test Fuse.slnx --configuration Release --no-build --verbosity normal" --output coverage.cobertura.xml --output-format cobertura
+        run: dotnet-coverage collect 'dotnet test Fuse.slnx --configuration Release --no-build --verbosity normal --filter "Category!=RequiresSdk"' --output coverage.cobertura.xml --output-format cobertura
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5

AGENTS.md

@@ -4,7 +4,7 @@
     <!-- Single source of truth for the product version, applied to every Fuse assembly so the CLI, the host,
          and FuseBuildInfo (the index version stamp) all report the same number. The release tag must match this
          (enforced by build/verify-version.ps1); bump every package in lockstep with build/set-version.ps1. -->
-    <Version>4.1.0</Version>
+    <Version>4.2.0</Version>
     <TargetFramework>net10.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
@@ -23,6 +23,12 @@
          writes and test method names unrelated to async correctness. Suppress the family repo-wide to keep the
          zero-warning gate; the host transport code itself is written fully async. -->
     <NoWarn>$(NoWarn);VSTHRD002;VSTHRD003;VSTHRD100;VSTHRD101;VSTHRD103;VSTHRD110;VSTHRD111;VSTHRD114;VSTHRD200</NoWarn>
+    <!-- Microsoft.Build.Locator 1.11.2 added the MSBL001 check that errors when the transitive Microsoft.Build.*
+         assemblies (pulled by Microsoft.CodeAnalysis.Workspaces.MSBuild) are copied to output. Fuse never loads
+         those copies: every entry point calls MSBuildLocator.RegisterDefaults() before touching any MSBuild type,
+         so the real MSBuild is resolved from the installed SDK, not the restored package. This is the documented
+         case the opt-out is for, and it preserves the pre-1.11.2 behavior the tool already shipped with. -->
+    <DisableMSBuildAssemblyCopyCheck>true</DisableMSBuildAssemblyCopyCheck>
   </PropertyGroup>
 
   <PropertyGroup Condition="!$(MSBuildProjectName.EndsWith('.Tests'))">
@@ -54,4 +60,26 @@
     <HttpActivityPropagationSupport>false</HttpActivityPropagationSupport>
     <UseSystemResourceKeys>true</UseSystemResourceKeys>
   </PropertyGroup>
+
+  <!-- R29: a version bump in this file must be reflected in the built assembly without a manual clean. The
+       incremental build can otherwise serve a stale-version bin after set-version.ps1. This target runs before
+       every compile and writes a generated marker only when its content (the version) changed
+       (WriteOnlyWhenDifferent), so the marker's timestamp advances exactly when Version changes. The marker is
+       an unconditional Compile input, so CoreCompile stays up to date on a normal build but is forced to rerun
+       (restamping the assembly version) when the version bump rewrites the marker. Cheap and harmless (one
+       assembly metadata attribute); the unconditional Compile item keeps the input list stable to avoid churn. -->
+  <Target Name="FuseStampVersionMarker" BeforeTargets="BeforeCompile;CoreCompile">
+    <PropertyGroup>
+      <_FuseVersionMarkerContent>// Generated by Directory.Build.props (R29): forces a recompile when Version changes.
+[assembly: System.Reflection.AssemblyMetadata("FuseBuildVersion", "$(Version)")]</_FuseVersionMarkerContent>
+    </PropertyGroup>
+    <WriteLinesToFile File="$(IntermediateOutputPath)FuseVersionMarker.g.cs"
+                      Lines="$(_FuseVersionMarkerContent)"
+                      Overwrite="true"
+                      WriteOnlyWhenDifferent="true" />
+    <ItemGroup>
+      <Compile Include="$(IntermediateOutputPath)FuseVersionMarker.g.cs" />
+      <FileWrites Include="$(IntermediateOutputPath)FuseVersionMarker.g.cs" />
+    </ItemGroup>
+  </Target>
 </Project>

CHANGELOG.md

@@ -1,38 +1,58 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <!-- Pin transitive dependencies that have a PackageVersion here, so a vulnerable transitive can be lifted to a
+         patched version without taking a direct dependency. Used for Microsoft.Bcl.Memory below. -->
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="DotMake.CommandLine" Version="3.1.0" />
     <PackageVersion Include="DotNet.Glob" Version="3.1.3" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.3" />
-    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.3" />
-    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.3" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="4.14.0" />
-    <!-- Pinned so the build-capture worker (which pulls Basic.CompilerLog's floor dependency on VisualBasic 4.8)
-         resolves VisualBasic to 4.14, matching CodeAnalysis.Common 4.14; a 4.8 VB assembly over a 4.14 Common
-         throws TypeLoadException. The worker never compiles VB; the pin is purely for version consistency. -->
-    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="4.14.0" />
-    <PackageVersion Include="Microsoft.Build.Locator" Version="1.7.8" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.10" />
+    <!-- The Roslyn family is pinned to one version. The metapackage (Microsoft.CodeAnalysis) and the *.Common
+         components arrive transitively (Basic.CompilerLog.Util) at an older floor with exact-version dependencies
+         that conflict with the 5.6.0 stack; pinning them forward via transitive pinning keeps the whole graph
+         version-consistent, so no NU1608 constraint mismatch fails the MSBuildWorkspace design-time load. -->
+    <PackageVersion Include="Microsoft.CodeAnalysis" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Common" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.Common" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.6.0" />
+    <!-- Pinned so the build-capture worker (which pulls Basic.CompilerLog's floor dependency on an older VisualBasic)
+         resolves VisualBasic to 5.6.0, matching CodeAnalysis.Common 5.6.0; a mismatched VB assembly over a newer
+         Common throws TypeLoadException. The worker never compiles VB; the pin is purely for version consistency. -->
+    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic" Version="5.6.0" />
+    <!-- VisualBasic.Workspaces arrives transitively (Basic.CompilerLog.Util) at an older floor whose exact-version
+         dependencies (Common = 4.8.0, etc.) conflict with the 5.6.0 stack. Pinned forward to 5.6.0 via transitive
+         pinning so the whole Roslyn graph is version-consistent; otherwise the NU1608 constraint mismatch fails the
+         MSBuildWorkspace design-time load and blocks fuse_refactor. -->
+    <PackageVersion Include="Microsoft.CodeAnalysis.VisualBasic.Workspaces" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Workspaces.MSBuild" Version="5.6.0" />
+    <PackageVersion Include="Microsoft.Build.Locator" Version="1.11.2" />
     <!-- N4 tier-1 build capture. Referenced ONLY by the out-of-process Fuse.BuildCaptureWorker (never by the
          parent process that hosts MSBuildWorkspace), because the two Roslyn-loading closures conflict in one
-         process; the worker uses build capture and never invokes MSBuildWorkspace, so its 4.8 floor resolves to
-         this repo's 4.14 without breaking anything. -->
+         process; the worker uses build capture and never invokes MSBuildWorkspace, so its floor resolves to
+         this repo's 5.6.0 without breaking anything. -->
     <PackageVersion Include="Basic.CompilerLog.Util" Version="0.9.47" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.3" />
+    <!-- Transitive of Microsoft.ML.Tokenizers.Data.* and Basic.CompilerLog.Util. 9.0.4 (the version they request)
+         carries a high-severity advisory (GHSA-73j8-2gch-69rq); pinned forward to the patched net10-aligned 10.0.10
+         via CentralPackageTransitivePinningEnabled. Without this, MSBuild design-time restore fails the audit and
+         MSBuildWorkspace refuses to load the solution, which blocked fuse_refactor. -->
+    <PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.10" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
     <PackageVersion Include="Microsoft.ML.OnnxRuntime" Version="1.27.0" />
-    <PackageVersion Include="Microsoft.ML.Tokenizers" Version="1.0.2" />
-    <PackageVersion Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="1.0.2" />
-    <PackageVersion Include="Microsoft.ML.Tokenizers.Data.O200kBase" Version="1.0.2" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
-    <PackageVersion Include="ModelContextProtocol" Version="0.8.0-preview.1" />
+    <PackageVersion Include="Microsoft.ML.Tokenizers" Version="2.0.0" />
+    <PackageVersion Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="2.0.0" />
+    <PackageVersion Include="Microsoft.ML.Tokenizers.Data.O200kBase" Version="2.0.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageVersion Include="ModelContextProtocol" Version="1.4.1" />
     <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
     <PackageVersion Include="StreamJsonRpc" Version="2.21.10" />
-    <PackageVersion Include="System.IO.Hashing" Version="9.0.0" />
-    <PackageVersion Include="xunit" Version="2.9.2" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
+    <PackageVersion Include="System.IO.Hashing" Version="10.0.10" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
 </Project>

Directory.Build.props

@@ -19,6 +19,7 @@
       <Project Path="src/Core/Fuse.Fusion/Fuse.Fusion.csproj" />
       <Project Path="src/Core/Fuse.Indexing/Fuse.Indexing.csproj" />
       <Project Path="src/Core/Fuse.Semantics/Fuse.Semantics.csproj" />
+      <Project Path="src/Core/Fuse.Scoping/Fuse.Scoping.csproj" />
       <Project Path="src/Core/Fuse.Workspace/Fuse.Workspace.csproj" />
       <Project Path="src/Core/Fuse.Retrieval/Fuse.Retrieval.csproj" />
       <Project Path="src/Core/Fuse.Context/Fuse.Context.csproj" />
@@ -46,6 +47,7 @@
     <Project Path="src/Core/Fuse.Semantics/Fuse.Semantics.csproj" />
     <Project Path="src/Core/Fuse.Workspace/Fuse.Workspace.csproj" />
     <Project Path="src/Core/Fuse.Retrieval/Fuse.Retrieval.csproj" />
+    <Project Path="src/Core/Fuse.Scoping/Fuse.Scoping.csproj" />
     <Project Path="src/Core/Fuse.Context/Fuse.Context.csproj" />
   </Folder>
   <Folder Name="/src/Plugins/">

Directory.Packages.props

@@ -47,12 +47,12 @@ syntax-level indexing for that project and reports the mode.
 - **Pack branch context.** `fuse_review` seeds on the git diff and returns related callers,
   handlers, and tests with provenance. On 69 recorded pull requests the median response was
   1,026 tokens at 93.4 percent precision (`review.json`).
-- **Read warm.** On the recorded NodaTime run, exact symbol lookup took 2.2 ms at the
-  median, task localization 23.4 ms, and review planning 97.8 ms (`performance.json`;
-  timings are environment-dependent).
+- **Read warm.** On the recorded NodaTime run (semantic tier, 14,760 symbols), exact
+  symbol lookup took 1.8 ms at the median, task localization 15.7 ms, and review planning
+  106.3 ms (`performance.json`; timings are environment-dependent).
 
 <p align="center">
-  <img src="assets/fuse-wiring-example.svg" alt="Fuse resolves an interface through dependency injection registration to its concrete implementation and related callers." width="820">
+  <img src="assets/fuse-typed-wiring.svg" alt="Fuse resolves an interface through dependency injection registration to its concrete implementation and related callers." width="820">
 </p>
 
 ## Use It During Daily Work

Fuse.slnx

@@ -37,3 +37,21 @@ Out of scope:
 ## Safe Defaults
 
 Fuse indexes and serves code locally. It does not send your repository to a remote model as part of indexing. Verify MCP client configuration if you use cloud-hosted models alongside Fuse tools.
+
+## Local-Trust Host IPC
+
+`fuse host` exposes a JSON-RPC surface over a named pipe (Windows) or Unix domain socket (Linux and macOS). Fuse treats this as **local-trust IPC**, not a network-authenticated service.
+
+**Any local user who can open the pipe can call RPC** once they hold the session token from `fuse/handshake`. On a typical developer workstation, any process running as your OS user can connect to local pipes and sockets. The predictable per-repository endpoint name is intentional (clients find the daemon without an out-of-band address), not a secret.
+
+Three mechanisms reduce casual abuse without pretending the endpoint is internet-hardened:
+
+| Layer | Mechanism | Limit |
+|-------|-----------|-------|
+| Endpoint | Pipe or socket name derived from the repository root | Does not hide the endpoint from other same-user processes |
+| Handshake | Random session token required on every method after `fuse/handshake` | Not a substitute for login; a same-user peer can observe the handshake |
+| Served root | Every RPC with a `root` argument must match the daemon's `--directory` | Blocks pivoting to a different repository path through the RPC surface |
+
+On Windows, set `FUSE_HOST_RESTRICT_PIPE=1` before starting `fuse host` to restrict the named-pipe ACL to the current user only (off by default). Unix domain sockets remain governed by filesystem permissions under the system temp directory.
+
+For the full threat model, exposure table, and operational guidance, see [Host RPC threat model](https://fuse.codes/docs/internals/host-rpc) (`site/content/docs/internals/host-rpc.mdx` in the repository).