Repository navigation
Upstream sync 13N: merge DeusData 612eee251 (0 behind upstream main) with #2749 argv search port - #35
Merged
Merged
Conversation
Signed-off-by: Andy11-cpu <canada11@duck.com>
Signed-off-by: Andy11-cpu <canada11@duck.com>
Signed-off-by: Andy11-cpu <canada11@duck.com>
Maintainer carry of DeusData#1862 (persistent install-hook opt-out, direction approved in DeusData#753). Main's current behaviour is kept everywhere; only the PR's intent -- persisting `install --no-hooks` / `--hooks` -- is re-applied on top of it. Textual conflicts: - docs/CONFIGURATION.md: both sides appended rows to the "Current keys" table. Kept main's `index_max_files` and `index_max_source_mb` rows unchanged, then added the PR's `install_hooks` row after them. The PR's explanatory paragraph follows the table, so the table stays one contiguous block. - src/main.c (print_help): main added a second `install` usage line for `[--clients=<tokens>]`; the PR appended `[--hooks|--no-hooks]` to the first line. Kept both: main's first line plus the PR's hook flags, followed by main's `--clients` line unchanged. Semantic conflicts (merged cleanly as text, wrong against main): - src/cli/cli.c, install_claude_code_config() --no-hooks branch: main now registers Claude hooks shell-free (DeusData#1733), as `<binary> hook-augment`, and changed cbm_remove_session_hooks() to take (settings_path, binary_path). The PR's disable path still called cbm_remove_session_hooks(settings_path), which no longer compiles, and used the NULL-binary cbm_remove_claude_hooks() / cbm_remove_claude_subagent_hooks() wrappers, which do not match the exec-form entries main installs. The disable path now calls the same binary-aware removers as main's uninstall_claude_code(): cbm_remove_claude_hooks_with_binary(), cbm_remove_session_hooks(..., binary_path) and cbm_remove_claude_subagent_hooks_with_binary(), all with the binary_path the install side registers. Legacy shell-form entries are still covered through those functions' old_commands lists. - tests/test_cli.c, cli_install_hooks_preference_persists_and_migrates_owned_state: the settings.json checks looked for "cbm-code-discovery-gate", but main no longer writes that name into settings.json (main's own cli_claude_hook_commands_use_exec_form_with_custom_config_dir asserts it is absent). The presence checks would be RED and the absence checks would pass without testing anything. They now use "hook-augment", the owned marker main's tests use. The script-file checks are unchanged, because main still writes the shim scripts. - scripts/smoke-test.sh 8e-i: same stale marker. The --no-hooks check now also rejects "hook-augment" in settings.json, and the --hooks check requires it. Both checks use "$GATE_SCRIPT" (set per platform in 8e) in place of the extensionless shim path, which on Windows (.cmd) could never exist and so checked nothing there. Everything else (cli.c hook gating, cli.h key, README, CONFIG_KEYS table, test registrations) auto-merged against main without change. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…eusData#2634) Signed-off-by: tahodev <85001874+tahodev@users.noreply.github.com>
When the Java resolver resolves a call's receiver to a type outside the project (a JDK package, or a package no project file declares), the call gets strategy lsp_external. Both pipeline paths (pass_calls.c and pass_parallel.c) then look the target up strictly by QN through cbm_pipeline_java_external_target and skip the registry's name guess, so no edge is created to an unrelated project method of the same name. This is the rule the Rust path follows since DeusData#2053. Positive proof only: a receiver of unknown type keeps the existing guess, and a seeded JDK type that lacks the called method stays no_method_match. Type variables (T, ID) are never taken for package-qualified types. A package counts as the project's when any registry layer holds a project type in it (the layer above the shared registry is a per-file overlay), and a path-derived spelling counts as the project's also for a file at the repository root. java_receiver_is_external memoizes its answer per package. A type of the caller's own package, or of its own file, now shadows java.lang (JLS 6.4.1): java_resolve_type_name looks the JVM package up before the java.lang auto-import. Before the gate that wrong first answer was harmless, since the name guess still found the project class; with the gate a project `Enum` or `Process` would read as external. Only the parallel path builds the Java cross registry, so on the sequential path the gate does not fire yet; the next commit adds it. Tests: java_typed_calls_parallel (external receivers get no edge; a project receiver keeps its edge, also when its type is missing from a project package or shares its simple name with a java.lang type), parallel_java_external_target_contract. Signed-off-by: Timur Nizametdinov <7229951+tfactor2@users.noreply.github.com>
pass_lsp_cross.c built the shared Java registry only on the parallel path (more than 50 files). On the sequential path every Java file was resolved against its own definitions alone, so a call on a type from another file fell back to the name guess, and the external-receiver gate of the previous commit never fired. This is a behaviour change for every repository of 50 files or fewer: calls whose receiver type is declared in another file now resolve through the LSP, as they do on the parallel path, and calls on JDK and library types lose their guessed edge. It also fixes the package-qualified parameter case measured in DeusData#2382. Tests: java_typed_calls_sequential (the parallel fixture on the sequential path, plus a parameter typed with its package-qualified name), java_typed_calls_paths_agree (both paths produce the same edges). Signed-off-by: Timur Nizametdinov <7229951+tfactor2@users.noreply.github.com>
On Windows the parallel path binds `c.getName()` (Customer comes from an import) to Filters.getName: the textual registry's name guess picks another same-named method there. This PR does not change that guess, so the test no longer pins its target: - on the parallel path, customerName only has to keep an edge; the sequential path still checks Customer.getName; - java_typed_calls_paths_agree compares only the edges the Java resolver found by type (lsp_*), not the registry's. Signed-off-by: Timur Nizametdinov <7229951+tfactor2@users.noreply.github.com>
After a successful re-index the next poll waits max(interval, 3 x index duration), capped at 30 min, counted from when the index finished. A project whose full rebuild takes minutes no longer re-indexes back-to-back under continuous writes; indexing spends at most ~1/4 of wall time. Sub-second indexes keep the existing cadence; failure backoff and busy-skip are unchanged. Logs watcher.cooldown when the delay is extended. Refs DeusData#2835 Signed-off-by: Shane McCarron <shane.mccarron@corvexconnect.com>
…of chunked grep Signed-off-by: tahodev <85001874+tahodev@users.noreply.github.com>
Signed-off-by: tahodev <85001874+tahodev@users.noreply.github.com>
Signed-off-by: tahodev <85001874+tahodev@users.noreply.github.com>
Maintainer refresh of DeusData#1862 (persistent install-hook opt-out, direction decided in DeusData#753) onto main a5b248f. The first refresh is 2577a86 and carries the semantic fixes for shell-free Claude hooks. Textual conflicts, all resolved by keeping both sides: - src/cli/cli.h: main added CBM_CONFIG_DOC_CANDIDATES on the line where the PR added CBM_CONFIG_INSTALL_HOOKS. Both defines are kept, in alphabetical order. - src/cli/cli.c CONFIG_KEYS[]: main added the watch_non_git row where the PR added install_hooks. Main row stays first, followed by the install_hooks row. - src/cli/cli.c Codex hook install: main (DeusData#2719) declared pretool_written in front of the hooks.json branch the PR prefixed with its --no-hooks removal branch. The declaration stays first, then the PR removal branch, then main hooks.json and config.toml upsert branches unchanged. Check: for every file the PR touches, the added and removed lines of the merged tree against main equal those of the PR against its old base. No compile-level semantic conflict: no function the PR calls changed its signature, and the PR re-signs no function main calls. The new Codex PreToolUse hook from DeusData#2719 is gated by the opt-out in the next commit. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Since DeusData#1180 a bare ~/.claude directory no longer counts as a Claude Code install. The fixture of cli_no_hooks_plan_covers_every_hook_installer_family now also writes .claude/settings.json. Without it claude-code drops out of agents_detected and the test fails on the tree merged with current main. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…-out DeusData#2719 added a PreToolUse Bash hook for Codex after this opt-out was written. In config.toml it lives inside the managed block, which the opt-out already removes. In hooks.json it is a separate entry beside the lifecycle pair, and the opt-out removed only the pair, so after install --no-hooks, and on every later bare install or update that respects the stored preference, our PreToolUse hook stayed registered. The --no-hooks branch now also calls cbm_remove_codex_pretool_hooks_json, the exact-command remover that uninstall uses since DeusData#2719. A PreToolUse hook the user owns is left alone. Test: cli_no_hooks_removes_codex_pretool_hook drives the real install dispatch through both hook representations. A default install writes ours beside a foreign hook; --no-hooks and a bare install with the stored preference remove ours and keep the foreign hook and the MCP entry; and --hooks restores ours. Without the fix it fails: ours is still in hooks.json after --no-hooks. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch up to main (a5b248f); it was 670 commits behind. One conflict, in src/pipeline/pass_calls.c: main (d4273ae) moved the LSP-target lookup of resolve_single_call into calls_emit_lsp_target and the registry fallback into calls_registry_resolution. The Java gate of this branch now lives in those helpers, unchanged in effect: - resolve_single_call computes java_external once, as before, and passes it to both helpers; - calls_emit_lsp_target looks a Java lsp_external callee up strictly by QN with no tail match, as the branch did inline; - calls_registry_resolution skips the name guess for such a call, next to the Rust and PHP vendor skips. pass_parallel.c, pass_lsp_cross.c, lsp_resolve.h, Makefile.cbm and the test registrations merged without conflicts. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The review of this change named a literal case: a project class Enum in package com.acme.protogen, and new Enum(cls, "parent") in a sibling class of that package (Netflix conductor has this shape: protogen.Enum). java.lang is an on-demand import, and an on-demand import never shadows a type of the own package (JLS 6.4.1), so the call means the project class. java_typed_calls_own_package_enum_sequential and _parallel index that pair on both pipeline paths and assert one CALLS edge from addNestedEnum to the Class node com.acme.protogen.Enum, as new does for every project type here. RED with only the type-name order of this branch reverted (java.lang before the own package): Enum reads as java.lang.Enum, the call counts as external, and both new tests find no edge. GREEN with this branch. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…t sleeping Review feedback on DeusData#2840: - Cap the success cooldown at INDEX_FAIL_CEILING_MS (5 min) instead of a separate 30-minute ceiling, so under continuous writes a project falls at most one rebuild plus five minutes behind. The 3x factor is unchanged below the cap. - Add two CBM_ENABLE_TEST_SEAMS hooks: freeze the watcher's scheduling clock, and read a project's next_poll_ns. The wire-up test now advances the frozen clock inside index_fn instead of sleeping 1.8 s, and asserts the exact scheduled poll time for an instant index, a 60 s index (180 s, counted from the END of the index) and a 200 s index (capped at 300 s). Refs DeusData#2835 Signed-off-by: Shane McCarron <shane.mccarron@corvexconnect.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…-out install --no-hooks and the persisted install_hooks=false preference removed the Augment SessionStart and PostToolUse view registrations from ~/.augment/settings.json but left the two scripts they pointed at, ~/.augment/hooks/codebase-memory-session.sh and codebase-memory-coverage.sh (.ps1 on Windows), on disk. The opt-out now deletes them the way uninstall does. Both paths share remove_augment_owned_hook_scripts(): each script is rebuilt from the binary path the install embedded and removed with cbm_text_remove_owned_document() only on a byte-for-byte match, so a script the user edited, or a foreign file with the same name, is kept. Uninstall keeps its error operation names; the opt-out records session_script_disable and coverage_script_disable. install --hooks writes both scripts again. Test: cli_no_hooks_removes_augment_owned_scripts drives the install command with fake activation ops in a temporary HOME: default install, --no-hooks (both scripts gone, MCP entry kept), a bare install with the stored preference (still gone), --hooks (restored), and a user-edited session script that --no-hooks keeps while it deletes the untouched coverage script. The test ends on --hooks because the opt-out is process state that later tests rely on. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
… of aborting the index (DeusData#2646) semantic_manifest_control_entry() reads the metadata of every entry the control-file walk lists, and one failed read fails the whole manifest. On Win32 the plain path <dir>\nul names the NUL device, so a real file named nul (Git Bash leaves one behind after `cmd > nul` or `2>nul`) cannot be read: GetFileAttributesExW fails with ERROR_INVALID_PARAMETER. The manifest returns CBM_NOT_FOUND and every index run on the repository ends in CBM_PIPELINE_ABORT_PRESERVE_DB (aborted_previous_preserved). Listing nul in .gitignore does not help, because the walk visits every entry. Only directories and control files can contribute to the manifest. Decide the control name first and skip an entry that the listing already shows to be neither, without reading it. A Windows listing always carries the attributes; on POSIX an entry whose d_type is DT_UNKNOWN is still read. Directories and control-named entries are read exactly as before. Signed-off-by: Tanishq <slatorgator3@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Bring the branch up to main e0c7a1d (DeusData#2395), which includes DeusData#1724 (index resource worker and publication fence, 008b6c3). Conflict resolved (1 file): - docs/CONFIGURATION.md: both sides appended rows to the "Current keys" table at the same spot. Resolved as main rows index_max_rss_mb and index_max_duration_seconds first, then the branch row install_hooks and its paragraph that closes the table. No conflict side was concatenated as-is; the branch paragraph must follow the last table row. Auto-merged without conflict: README.md, src/cli/cli.c (CONFIG_KEYS now holds the new index_max_rss_mb / index_max_duration_seconds keys and install_hooks), src/main.c (worker publish-fence argv next to the --hooks/--no-hooks help line). Check: for all seven branch files, the zero-context patch-id of the merged tree against main equals the branch own change. Semantic check: the branch re-signs no function; main re-signed the daemon worker start callback and the supervisor result struct, which the branch does not use. No call site adapted. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Add .github/workflows/freebsd.yml, a standalone workflow triggered only by workflow_dispatch. It builds the UI-embedded binary inside FreeBSD 15.1 and 14.4 x86_64 VMs (vmactions/freebsd-vm, full-SHA pin to v1.5.9) with the canonical scripts/build.sh and runs the binary with --version. It declares read-only permissions, uploads and publishes nothing, is not part of ci-ok and is not called by release.yml or dry-run.yml, so a FreeBSD red never gates a pull request or a release. scripts/env.sh now detects FreeBSD and selects gmake there (BSD make cannot read the GNU make syntax of Makefile.cbm) and make everywhere else; the environment summary line reports the choice. scripts/build.sh runs $MAKE at all three build call sites. macOS, Linux and Windows still run make, so their builds are unchanged. Distilled from DeusData#1422 by PR9000: the release matrix, the x86_64-host choice, the aarch64 exclusion, the vmactions VM approach with a SHA pin, fail-fast: false and the gmake detection all come from that pull request, which built on the FreeBSD groundwork of DeusData#1093, DeusData#1423 and DeusData#1467. Co-authored-by: Pedro Ramos <131530838+pr9000@users.noreply.github.com> Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The first proof run failed in both FreeBSD legs at `npm ci`: the UI dependency tree pulls in onnxruntime-node, which publishes builds for win32, darwin and linux only, so npm stops with EBADPLATFORM before the frontend is built. The VM boot, the pkg prepare step, the gmake detection and the source sync all worked. The job now builds the headless binary (scripts/build.sh without --with-ui) and drops node22/npm-node22 from the prepare step. That still proves the C core builds and starts on FreeBSD; the UI bundle is platform-independent JavaScript and is built on every other leg. The aarch64 comment now says what is actually unproven. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…ook-opt-out feat(cli): persist install hook opt-out
feat(java): no name guess for calls on a proven-external receiver
refactor(search): run POSIX unscoped scan as argv stages, no shell (DeusData#2634)
…cooldown fix(watcher): pace re-indexes by the cost of the last successful run
…-nul-file fix(pipeline): skip a file named nul in the control-file walk instead of aborting the index (DeusData#2646)
…rkflow ci(freebsd): add a dispatch-only, informational FreeBSD build workflow
…fork Ancestry-preserving merge of upstream DeusData/codebase-memory-mcp main at 612eee2 ("Merge pull request DeusData#2911 ... FreeBSD dispatch workflow"). First parent is the 13M-2 integration head; 39 upstream-only commits across 6 first-parent merges: DeusData#1862 persistent install hook opt-out, DeusData#2667 Java external-receiver resolution gate, DeusData#2749 POSIX shell-free search_code scan, DeusData#2840 watcher reindex cooldown, DeusData#2903 manifest walk skips reserved `nul`, DeusData#2911 FreeBSD build workflow (workflow_dispatch only, non-gating). Conflict resolution (CLI-first): - src/mcp/mcp.c, tests/test_mcp.c: kept deleted. DeusData#2749's search change is ported to src/operations/source_search.c in the next commit. - README.md, scripts/smoke-test.sh, scripts/memory-core-baseline.txt, src/main.c help text: fork side (CLI identity, CLI-first smoke, operations baseline entries; no src/mcp entries). - docs/CONFIGURATION.md: fork command list plus `config get install_hooks`. - src/watcher/watcher.{c,h}: upstream success cooldown (DeusData#2840) anchored at index completion; failures/busy-skip keep the fork's after-index anchor and overflow-guarded schedule. Duplicate cbm_watcher_test_next_poll_ns (identical semantics) removed; upstream clock seam kept. - src/cli/cli.c (DeusData#1862, resolved by a Codex gpt-6-luna agent, verified here): `install --no-hooks` removes CLI-owned hooks and persists install_hooks=false; plain install/update/install-hooks honour it; `install --hooks` persists true. Applied to the fork's hook installers only; user-owned hooks, Codex asset/hook surface split, activation path checks and dry-run no-write behaviour retained. No MCP registration or config writing restored. main.c install usage shows [--hooks|--no-hooks]. Checks: build-dev.sh and build/c/test-runner compile with -Werror; lint-memory-core passes (3201 raw sites, none grew); strict Actions policy passes (freebsd.yml is dispatch-only); the 4 DeusData#1862 tests and 5 DeusData#2840 watcher tests pass (9/9).
Port of upstream DeusData PR DeusData#2749 (issue DeusData#2634) to the operations layer. The unscoped source search (project root with no indexed file list) used to build a /bin/sh -c script that interpolated the search root and file pattern into find/sort/xargs/grep text. On POSIX it now runs find and sort as supervised argv stages (no shell) that write the NUL-delimited, LC_ALL=C sorted candidate list, then feeds that list to the existing in-process scanner (search_scan_in_process) that scoped projects already use. The root and file pattern reach find as plain arguments (-type f -name PATTERN -print0), so shell metacharacters in file names are ordinary bytes. New helper cbm_operation_run_argv_stage_bounded (command_runner.c/.h, POSIX-only) mirrors the shell runner's contract: cancellation, deadline and cumulative output-budget latches are polled around the child, a latched condition cancels the process tree, and uncontained trees map to SUPERVISION_FAILURE. find/sort failures fail closed; an empty list is a successful empty scan. The shell path remains for runtime->command_override (test seam) and for Windows, whose behaviour is unchanged. validate_search_args is unchanged, so roots and file patterns containing quotes, ';', '|', '$', backticks, etc. are still rejected up front; only discovered file names are unrestricted. Tests (tests/test_integration.c, POSIX only): metacharacter file names (quote, space, ';', backtick, '$(...)', leading '-', '|&') are found and no command executes; no-match is success; file_pattern is honoured and a shell-syntax pattern is rejected; cancellation, deadline and output-limit errors for the unscoped scan. No raw allocator sites added; memory-core baseline unchanged.
…61108 Brings the Hermes hook test fix (0f1927f) from 13M-2 into 13N.
…ification Adds per-batch receipts (13m1.md, 13m2.md, 13n.md) and updates ledger.json, PLAN.md and CONTINUE.md for the 2026-11-08 upstream closeout against DeusData 612eee2. Jenkins release-tooling full gate, exact heads: - 13M-1 c3c5271: DeusData#90 SUCCESS; merged to main via PR #33 (929adfe). DeusData#89 on 3cbefe2 failed only on the index_policy fixture fixed there. - 13M-2 0f1927f: DeusData#93 SUCCESS. DeusData#91 on 1c5f82a failed two upstream Hermes hook cycle tests, fixed in 0f1927f. - 13N 98eab3c: DeusData#94 SUCCESS. DeusData#92 on cf24b6a was aborted because that head lacked the 13M-2 test fix. Native Windows was not run for any batch, so the reserved-`nul` change (DeusData#2903) is unverified on Windows. This commit only touches docs; the code Jenkins qualified is 98eab3c.
|
Caution Review failedThe pull request is closed.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
ngallodev
marked this pull request as ready for review
November 9, 2026 15:23
…61108 Brings the PR #34 review fixes (tree RSS descendants, PHP masker) into 13N.
…61108 Brings the cppcheck null-guard fix for the tree RSS probe into 13N.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third and last of three stacked upstream-sync PRs (13M-1 → 13M-2 → 13N). This one merges upstream checkpoint
612eee251(upstreammain) on top of the 13M-2 branch and brings the fork to upstreammain.The plan labels batches by upstream range: 13M-1 covers up to
5689ea54c, 13M-2 covers up toe0c7a1da6, and this PR covers the rest up to612eee251.Ancestry
0f1927fd3cf872aa3d85719339af255fb1890394612eee2518ef84cc573e491fdee5fa5c90264cb5(upstreammain; 39 commits and 6 first-parent PR merges aftere0c7a1da6)2efba854891c7edbc8839c8cce0a7fb9fa7dec11(parents6ec8d5873+612eee251)2dc699f794e5a93eb52fb64fd208eb57c80acefegit merge-base --is-ancestor 612eee251 2dc699f79holds. Relative to upstreammain, this branch is 442 ahead and 0 behind, so the fork is 0 commits behind upstreammainat612eee251. Relative to the 13M-2 PR head, the branch is 46 ahead and 0 behind.Commits on top of the merge
2efba8548: upstream checkpoint merge (612eee251).e4717235e: ports refactor(search): run POSIX unscoped scan as argv stages, no shell (#2634) DeusData/codebase-memory-mcp#2749 tosrc/operations/source_search.c. POSIX unscoped scans run as argvfindandsortstages throughsrc/operations/command_runner.{c,h}, with an in-process scan.validate_search_argsstill rejects metacharacters in scopes and patterns, as upstream does.cf24b6a32: merges the 13M-1 follow-ups into this branch.98eab3ceb: merges the 13M-2 PR head0f1927fd3to pick up the Hermes test fix. Againstcf24b6a32, this commit changes onlytests/test_cli.c.93474eae0: docs-only. Records the 13M-1, 13M-2 and 13N receipts and Jenkins results indocs/upstream-sync/.fe234b297,2dc699f79: merge the 13M-2 review fixes (tree-RSS descendants, PHP masker, test fixtures, cppcheck null guard).Retained upstream behavior
nulfile handling in the manifest walk. Native Windows behavior is unverified (see Verification).Excluded (MCP-only)
src/mcp/*andtests/test_mcp.c.src/daemon/frontend.*andtests/test_daemon_frontend.c. The frontend is deleted in the CLI fork..github/workflows/pr.ymland.github/workflows/test-impact-artifact.yml. These are automatic-trigger workflows, and this PR does not add automatic GitHub Actions triggers.release.yml.Verification
cf24b6a32(before the98eab3cebmerge):scripts/build-dev.shwith-Werror, memory-core lint (3,201 raw sites, none grew), strict Actions policy, feat(cli): persist install hook opt-out DeusData/codebase-memory-mcp#1862 and fix(watcher): pace re-indexes by the cost of the last successful run DeusData/codebase-memory-mcp#2840 tests 9/9, and source-search, integration, and index-policy tests 78/78.98eab3ceb: release-tooling build Bump sigstore/cosign-installer from f713795cb21599bc4e5c4b58cbad1da852d7eeb9 to 398d4b0eeef1380460a10c8013a76f728fb906ac DeusData/codebase-memory-mcp#94 SUCCESS. Build Add support for kiro-cli DeusData/codebase-memory-mcp#96 onfe234b297failed in cppcheck.2dc699f79: release-tooling build bug(mcp): tools/list hangs 60s when client sends initialize + notifications/initialized + tools/list in rapid succession DeusData/codebase-memory-mcp#98 SUCCESS. Build Bump crazy-max/ghaction-virustotal from 4.2.0 to 5.0.0 DeusData/codebase-memory-mcp#92 oncf24b6a32was aborted because that head lacked the Hermes test fix.nulhandling for fix(pipeline): skip a file named nul in the control-file walk instead of aborting the index (#2646) DeusData/codebase-memory-mcp#2903 remains unverified natively. Linux results say nothing about Windows parity.Migrations
None recorded in the 13N receipt.
Review
sync/upstream-13m2-20261108tomain.mainneeds explicit human approval.