refactor(search): run POSIX unscoped scan as argv stages, no shell

Port of upstream DeusData PR DeusData#2749 (issue DeusData#2634) to the operations layer.

The unscoped source search (project root with no indexed file list) used to
build a /bin/sh -c script that interpolated the search root and file pattern
into find/sort/xargs/grep text. On POSIX it now runs find and sort as
supervised argv stages (no shell) that write the NUL-delimited, LC_ALL=C
sorted candidate list, then feeds that list to the existing in-process
scanner (search_scan_in_process) that scoped projects already use. The root
and file pattern reach find as plain arguments (-type f -name PATTERN
-print0), so shell metacharacters in file names are ordinary bytes.

New helper cbm_operation_run_argv_stage_bounded (command_runner.c/.h,
POSIX-only) mirrors the shell runner's contract: cancellation, deadline and
cumulative output-budget latches are polled around the child, a latched
condition cancels the process tree, and uncontained trees map to
SUPERVISION_FAILURE. find/sort failures fail closed; an empty list is a
successful empty scan.

The shell path remains for runtime->command_override (test seam) and for
Windows, whose behaviour is unchanged. validate_search_args is unchanged, so
roots and file patterns containing quotes, ';', '|', '$', backticks, etc. are
still rejected up front; only discovered file names are unrestricted.

Tests (tests/test_integration.c, POSIX only): metacharacter file names
(quote, space, ';', backtick, '$(...)', leading '-', '|&') are found and no
command executes; no-match is success; file_pattern is honoured and a
shell-syntax pattern is rejected; cancellation, deadline and output-limit
errors for the unscoped scan.

No raw allocator sites added; memory-core baseline unchanged.

Author: ngallodev

src/operations/command_runner.c

@@ -241,6 +241,100 @@ cbm_operation_command_cause_t cbm_operation_run_shell_command_bounded(
                                                  : CBM_OPERATION_COMMAND_CONTAINED_FAILURE;
 }
 
+#ifndef _WIN32
+static void operation_argv_stage_poll_latches(const cbm_operation_runtime_t *runtime,
+                                              const char *measured_path, uint64_t output_base,
+                                              size_t output_limit, uint64_t deadline_ms,
+                                              bool deadline_enabled, bool *cancellation_latched,
+                                              bool *deadline_latched, bool *output_limit_latched) {
+    *cancellation_latched = *cancellation_latched || cbm_operation_runtime_cancelled(runtime);
+    *deadline_latched = *deadline_latched || (deadline_enabled && cbm_now_ms() >= deadline_ms);
+    if (!*output_limit_latched && output_limit > 0 && measured_path && measured_path[0]) {
+        int64_t measured_size = cbm_file_size(measured_path);
+        *output_limit_latched =
+            measured_size > 0 && output_base + (uint64_t)measured_size > output_limit;
+    }
+}
+
+cbm_operation_command_cause_t cbm_operation_run_argv_stage_bounded(
+    const cbm_operation_runtime_t *runtime, const char *bin, const char *const *argv,
+    const char *const *env_overrides, const char *stdout_capture, uint64_t output_base,
+    size_t output_limit, uint64_t deadline_ms, bool deadline_enabled, bool tolerate_exit_one,
+    bool *cancellation_latched, bool *deadline_latched, bool *output_limit_latched,
+    cbm_proc_result_t *result_out) {
+    if (!bin || !argv || !result_out || !cancellation_latched || !deadline_latched ||
+        !output_limit_latched) {
+        return CBM_OPERATION_COMMAND_FAILURE;
+    }
+    memset(result_out, 0, sizeof(*result_out));
+    operation_argv_stage_poll_latches(runtime, stdout_capture, output_base, output_limit,
+                                      deadline_ms, deadline_enabled, cancellation_latched,
+                                      deadline_latched, output_limit_latched);
+    if (*cancellation_latched || *deadline_latched || *output_limit_latched) {
+        result_out->tree_quiesced = true; /* no child was spawned */
+        if (*cancellation_latched) {
+            return CBM_OPERATION_COMMAND_CANCELLED;
+        }
+        return *deadline_latched ? CBM_OPERATION_COMMAND_DEADLINE
+                                 : CBM_OPERATION_COMMAND_OUTPUT_LIMIT;
+    }
+    cbm_proc_opts_t options = {
+        .bin = bin,
+        .argv = argv,
+        .env_overrides = env_overrides,
+        .log_file = NULL,
+        .quiet_timeout_ms = 0,
+        .cancel_grace_ms = CBM_SUBPROCESS_DEFAULT_CANCEL_GRACE_MS,
+        .delete_log_on_exit = false,
+        .strip_git_repo_env = false,
+        .stdout_file = stdout_capture,
+    };
+    cbm_subprocess_t *process = NULL;
+    if (cbm_subprocess_spawn(&options, &process) != 0) {
+        result_out->tree_quiesced = true;
+        return CBM_OPERATION_COMMAND_FAILURE;
+    }
+    cbm_proc_poll_t state;
+    for (;;) {
+        operation_argv_stage_poll_latches(runtime, stdout_capture, output_base, output_limit,
+                                          deadline_ms, deadline_enabled, cancellation_latched,
+                                          deadline_latched, output_limit_latched);
+        if (*cancellation_latched || *deadline_latched || *output_limit_latched) {
+            (void)cbm_subprocess_request_cancel(process);
+        }
+        state = cbm_subprocess_poll(process, result_out);
+        if (state != CBM_PROC_POLL_RUNNING) {
+            break;
+        }
+        cbm_usleep(OPERATION_COMMAND_POLL_US);
+    }
+    bool contained = state == CBM_PROC_POLL_TERMINAL && result_out->tree_quiesced &&
+                     !result_out->supervision_failed;
+    cbm_subprocess_destroy(process);
+    operation_argv_stage_poll_latches(runtime, stdout_capture, output_base, output_limit,
+                                      deadline_ms, deadline_enabled, cancellation_latched,
+                                      deadline_latched, output_limit_latched);
+    if (!contained) {
+        return CBM_OPERATION_COMMAND_SUPERVISION_FAILURE;
+    }
+    if (*cancellation_latched) {
+        return CBM_OPERATION_COMMAND_CANCELLED;
+    }
+    if (*deadline_latched) {
+        return CBM_OPERATION_COMMAND_DEADLINE;
+    }
+    if (*output_limit_latched) {
+        return CBM_OPERATION_COMMAND_OUTPUT_LIMIT;
+    }
+    if (tolerate_exit_one && result_out->outcome == CBM_PROC_EXIT_NONZERO &&
+        result_out->exit_code == 1) {
+        return CBM_OPERATION_COMMAND_SUCCESS; /* ordinary grep-style no-match */
+    }
+    return result_out->outcome == CBM_PROC_CLEAN ? CBM_OPERATION_COMMAND_SUCCESS
+                                                 : CBM_OPERATION_COMMAND_CONTAINED_FAILURE;
+}
+#endif
+
 int cbm_operation_run_shell_command(const cbm_operation_runtime_t *runtime, const char *command,
                                     char output_path[CBM_SZ_2K], cbm_proc_result_t *result_out) {
     cbm_operation_command_cause_t cause = cbm_operation_run_shell_command_bounded(

src/operations/command_runner.h

@@ -26,6 +26,19 @@ cbm_operation_command_cause_t cbm_operation_run_shell_command_bounded(
     size_t output_limit, uint64_t deadline_ms, bool deadline_enabled, bool deadline_latched,
     bool exit_one_is_no_match, cbm_proc_result_t *result_out);
 
+#ifndef _WIN32
+/* POSIX-only: supervised run of one argv stage (no shell). Same latch and
+ * containment contract as the shell runner. The measured stdout_capture file's
+ * size plus output_base counts toward output_limit so chained stages share one
+ * budget. tolerate_exit_one maps a plain exit-1 (grep's no-match) to SUCCESS. */
+cbm_operation_command_cause_t cbm_operation_run_argv_stage_bounded(
+    const cbm_operation_runtime_t *runtime, const char *bin, const char *const *argv,
+    const char *const *env_overrides, const char *stdout_capture, uint64_t output_base,
+    size_t output_limit, uint64_t deadline_ms, bool deadline_enabled, bool tolerate_exit_one,
+    bool *cancellation_latched, bool *deadline_latched, bool *output_limit_latched,
+    cbm_proc_result_t *result_out);
+#endif
+
 /* Compatibility shape used by detect-changes style callers: any contained
  * terminal process tree is considered wrapper success and the caller inspects
  * result_out for exit/cancellation classification. */

src/operations/source_search.c

@@ -2294,6 +2294,51 @@ int cbm_source_search_scan_for_test(const cbm_operation_runtime_t *runtime,
 }
 #endif
 
+#ifndef _WIN32
+/* The unscoped scan with no shell anywhere: find writes the NUL-delimited
+ * candidate list and LC_ALL=C sort orders it in place, both as supervised argv
+ * stages, then the list feeds the same in-process scanner scoped projects use.
+ * The search root and file pattern reach find as plain arguments, never as
+ * shell text. find/sort failures fail closed; an empty list is a successful
+ * empty scan. */
+static cbm_operation_command_cause_t search_run_unscoped_argv(
+    const cbm_operation_runtime_t *runtime, const char *root_path, const char *file_pattern,
+    const char *pattern, bool use_regex, const char *filelist, FILE *out, size_t output_limit,
+    uint64_t deadline_ms, bool deadline_latched, cbm_proc_result_t *result_out) {
+    bool cancellation_latched = false;
+    bool output_limit_latched = false;
+    enum { FIND_ARGV_MAX = 9 };
+    const char *find_argv[FIND_ARGV_MAX];
+    int fa = 0;
+    find_argv[fa++] = "find";
+    find_argv[fa++] = root_path;
+    find_argv[fa++] = "-type";
+    find_argv[fa++] = "f";
+    if (file_pattern) {
+        find_argv[fa++] = "-name";
+        find_argv[fa++] = file_pattern;
+    }
+    find_argv[fa++] = "-print0";
+    find_argv[fa] = NULL;
+    cbm_operation_command_cause_t cause = cbm_operation_run_argv_stage_bounded(
+        runtime, "find", find_argv, NULL, filelist, 0, 0, deadline_ms, true, false,
+        &cancellation_latched, &deadline_latched, &output_limit_latched, result_out);
+    if (cause != CBM_OPERATION_COMMAND_SUCCESS) {
+        return cause;
+    }
+    const char *sort_argv[] = {"sort", "-z", "-o", filelist, filelist, NULL};
+    const char *sort_env[] = {"LC_ALL=C", NULL};
+    cause = cbm_operation_run_argv_stage_bounded(
+        runtime, "sort", sort_argv, sort_env, NULL, 0, 0, deadline_ms, true, false,
+        &cancellation_latched, &deadline_latched, &output_limit_latched, result_out);
+    if (cause != CBM_OPERATION_COMMAND_SUCCESS) {
+        return cause;
+    }
+    return search_scan_in_process(runtime, filelist, pattern, use_regex, out, output_limit,
+                                  deadline_ms);
+}
+#endif
+
 /* Open the scratch directory, write `pattern` to the grep -f file, and leave the
  * file list open for write_scoped_filelist. Returns true on success; on failure
  * everything already created is removed before returning. */
@@ -2791,13 +2836,20 @@ cbm_operation_result_t cbm_source_search_operation_execute(const char *args,
          * command overrides, and Windows patterns that need PowerShell's
          * post-filter semantics. */
         bool scan_in_process = scoped && !(runtime && runtime->command_override);
+        bool scan_argv = false;
+#ifndef _WIN32
+        /* POSIX unscoped scans run as find/sort argv stages feeding the
+         * in-process scanner: no shell parses the root or file pattern. The
+         * command override keeps the shell runner for tests. */
+        scan_argv = !scoped && !(runtime && runtime->command_override);
+#endif
 #ifdef _WIN32
         scan_in_process =
             scan_in_process &&
             (!file_pattern || cbm_search_code_file_pattern_can_prefilter(file_pattern));
 #endif
         cbm_operation_command_cause_t scan_cause;
-        if (scan_in_process) {
+        if (scan_in_process || scan_argv) {
             FILE *scan_out = NULL;
             if (scan_cancellation_latched || cbm_operation_runtime_cancelled(runtime)) {
                 scan_cause = CBM_OPERATION_COMMAND_CANCELLED;
@@ -2806,6 +2858,12 @@ cbm_operation_result_t cbm_source_search_operation_execute(const char *args,
             } else if (!(scan_out = search_scratch_file(scratch.dir, "scan", output_path,
                                                         sizeof(output_path)))) {
                 scan_cause = CBM_OPERATION_COMMAND_FAILURE;
+            } else if (scan_argv) {
+#ifndef _WIN32
+                scan_cause = search_run_unscoped_argv(
+                    runtime, root_path, file_pattern, pattern, use_regex, filelist, scan_out,
+                    scan_output_limit, scan_deadline_ms, scan_deadline_latched, &scan_result);
+#endif
             } else {
                 scan_cause = search_scan_in_process(runtime, filelist, pattern, use_regex, scan_out,
                                                     scan_output_limit, scan_deadline_ms);

tests/test_integration.c

@@ -2429,6 +2429,158 @@ TEST(port_source_search_drops_walker_hits_that_resolve_outside_root) {
     ASSERT_TRUE(total_counts_inside_only);
     PASS();
 }
+
+/* #2634: the POSIX unscoped scan runs find/sort as argv stages with no shell,
+ * feeding the in-process scanner. Run one query against a project whose root
+ * has no indexed files, so the scan walks the tree. */
+typedef struct {
+    port_cache_fixture_t cache;
+    char root[CBM_SZ_512];
+} port_argv_fixture_t;
+
+static bool port_argv_fixture_begin(port_argv_fixture_t *fx, const char *project) {
+    memset(fx, 0, sizeof(*fx));
+    if (!port_cache_begin(&fx->cache)) {
+        return false;
+    }
+    snprintf(fx->root, sizeof(fx->root), "%s/cbm-search-argv-XXXXXX", cbm_tmpdir());
+    return cbm_mkdtemp(fx->root) != NULL && port_create_project(fx->cache.cache, project, fx->root);
+}
+
+static void port_argv_fixture_end(port_argv_fixture_t *fx) {
+    if (fx->root[0]) {
+        th_rmtree(fx->root);
+    }
+    port_cache_end(&fx->cache);
+}
+
+static bool port_argv_write(const port_argv_fixture_t *fx, const char *name, const char *content) {
+    char path[CBM_SZ_1K];
+    int written = snprintf(path, sizeof(path), "%s/%s", fx->root, name);
+    return written > 0 && (size_t)written < sizeof(path) && th_write_file(path, content) == 0;
+}
+
+TEST(port_source_search_unscoped_argv_scans_metachar_filenames_issue2634) {
+    port_argv_fixture_t fx;
+    ASSERT_TRUE(port_argv_fixture_begin(&fx, "argv-meta"));
+    ASSERT_TRUE(port_argv_write(&fx, "we'ird ;na`me$.go", "func HandleHostile2634() {}\n"));
+    ASSERT_TRUE(port_argv_write(&fx, "$(touch pwned).c", "int HandleHostile2634;\n"));
+    ASSERT_TRUE(port_argv_write(&fx, "-lead.c", "int HandleHostile2634;\n"));
+    ASSERT_TRUE(port_argv_write(&fx, "a|b&c.c", "int HandleHostile2634;\n"));
+
+    char *resp = port_operation_execute(
+        "search_code",
+        "{\"pattern\":\"HandleHostile2634\",\"project\":\"argv-meta\",\"format\":\"json\"}", NULL);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "we'ird ;na`me$.go"));
+    ASSERT_NOT_NULL(strstr(resp, "$(touch pwned).c"));
+    ASSERT_NOT_NULL(strstr(resp, "-lead.c"));
+    ASSERT_NOT_NULL(strstr(resp, "a|b&c.c"));
+    ASSERT_NOT_NULL(strstr(resp, "\"total_grep_matches\":4"));
+    free(resp);
+
+    char pwned[CBM_SZ_1K];
+    snprintf(pwned, sizeof(pwned), "%s/pwned", fx.root);
+    ASSERT_FALSE(access(pwned, F_OK) == 0);
+    ASSERT_FALSE(access("pwned", F_OK) == 0);
+    port_argv_fixture_end(&fx);
+    PASS();
+}
+
+TEST(port_source_search_unscoped_argv_no_match_is_success_issue2634) {
+    port_argv_fixture_t fx;
+    ASSERT_TRUE(port_argv_fixture_begin(&fx, "argv-nomatch"));
+    ASSERT_TRUE(port_argv_write(&fx, "handler.go", "func HandlePresent2634() {}\n"));
+
+    char *resp = port_operation_execute(
+        "search_code",
+        "{\"pattern\":\"NoSuchSymbol2634\",\"project\":\"argv-nomatch\",\"format\":\"json\"}",
+        NULL);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "\"total_grep_matches\":0"));
+    ASSERT_NOT_NULL(strstr(resp, "\"total_relation\":\"eq\""));
+    free(resp);
+    port_argv_fixture_end(&fx);
+    PASS();
+}
+
+TEST(port_source_search_unscoped_argv_honours_file_pattern_issue2634) {
+    port_argv_fixture_t fx;
+    ASSERT_TRUE(port_argv_fixture_begin(&fx, "argv-glob"));
+    ASSERT_TRUE(port_argv_write(&fx, "handler.py", "def handle_python2634():\n    return 1\n"));
+
+    char *resp =
+        port_operation_execute("search_code",
+                               "{\"pattern\":\"handle_python2634\",\"project\":\"argv-glob\","
+                               "\"file_pattern\":\"*.go\",\"format\":\"json\"}",
+                               NULL);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NULL(strstr(resp, "handler.py"));
+    ASSERT_NOT_NULL(strstr(resp, "\"total_grep_matches\":0"));
+    free(resp);
+
+    resp = port_operation_execute(
+        "search_code",
+        "{\"pattern\":\"handle_python2634\",\"project\":\"argv-glob\",\"format\":\"json\"}", NULL);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "handler.py"));
+    ASSERT_NOT_NULL(strstr(resp, "\"total_grep_matches\":1"));
+    free(resp);
+
+    /* A file_pattern carrying shell syntax is rejected before any process runs. */
+    resp = port_operation_execute("search_code",
+                                  "{\"pattern\":\"handle_python2634\",\"project\":\"argv-glob\","
+                                  "\"file_pattern\":\"*.py;touch pwned\"}",
+                                  NULL);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "invalid characters"));
+    free(resp);
+    port_argv_fixture_end(&fx);
+    PASS();
+}
+
+static bool port_argv_always_cancelled(void *context) {
+    (void)context;
+    return true;
+}
+
+TEST(port_source_search_unscoped_argv_cancel_deadline_and_output_limit) {
+    port_argv_fixture_t fx;
+    ASSERT_TRUE(port_argv_fixture_begin(&fx, "argv-bounds"));
+    ASSERT_TRUE(port_argv_write(&fx, "a.go", "func Bound2634() {}\nfunc Bound2634b() {}\n"));
+    ASSERT_TRUE(port_argv_write(&fx, "b.go", "func Bound2634c() {}\n"));
+    static const char args[] = "{\"pattern\":\"Bound2634\",\"project\":\"argv-bounds\"}";
+
+    cbm_operation_runtime_t cancel = {0};
+    cancel.cancelled = port_argv_always_cancelled;
+    char *resp = port_operation_execute("search_code", args, &cancel);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "cancelled"));
+    free(resp);
+
+    cbm_operation_runtime_t deadline = {0};
+    deadline.command_timeout_override_set = true;
+    deadline.command_timeout_override_ms = 0;
+    resp = port_operation_execute("search_code", args, &deadline);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "request_timeout"));
+    free(resp);
+
+    cbm_operation_runtime_t limit = {0};
+    limit.command_output_limit_override = 16;
+    resp = port_operation_execute("search_code", args, &limit);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "safety limit"));
+    free(resp);
+
+    /* Same query without bounds still succeeds and the scratch was cleaned. */
+    resp = port_operation_execute("search_code", args, NULL);
+    ASSERT_NOT_NULL(resp);
+    ASSERT_NOT_NULL(strstr(resp, "Bound2634"));
+    free(resp);
+    port_argv_fixture_end(&fx);
+    PASS();
+}
 #endif /* !_WIN32 */
 
 /* #2346 (cross-repo-status): every index_status answer carries a read-only
@@ -3248,6 +3400,10 @@ SUITE(integration) {
 #if !defined(_WIN32)
     RUN_TEST(port_source_search_matches_stay_inside_project_root);
     RUN_TEST(port_source_search_drops_walker_hits_that_resolve_outside_root);
+    RUN_TEST(port_source_search_unscoped_argv_scans_metachar_filenames_issue2634);
+    RUN_TEST(port_source_search_unscoped_argv_no_match_is_success_issue2634);
+    RUN_TEST(port_source_search_unscoped_argv_honours_file_pattern_issue2634);
+    RUN_TEST(port_source_search_unscoped_argv_cancel_deadline_and_output_limit);
 #endif
     RUN_TEST(port_status_reports_cross_repo_never_run);
     RUN_TEST(port_search_graph_infra_filters_pin_the_bm25_mirror);