Upstream sync 13N: merge DeusData 612eee251 (0 behind upstream main) with #2749 argv search port

.github/workflows/freebsd.yml

@@ -0,0 +1,65 @@
+# FreeBSD build, INFORMATIONAL ONLY. Builds the headless binary (the C core,
+# no embedded UI) inside a FreeBSD VM with the canonical scripts/build.sh,
+# then checks that the binary starts (--version). The UI build is not run here:
+# its npm dependency tree pulls in onnxruntime-node, which publishes no FreeBSD
+# build, so `npm ci` stops with EBADPLATFORM. The UI bundle itself is
+# platform-independent JavaScript and is built on every other leg.
+#
+# NON-GATING: workflow_dispatch only. This workflow is not part of the ci-ok
+# aggregate and is not called by release.yml or dry-run.yml, so a FreeBSD red
+# never blocks a pull request or a release. Nothing from it is uploaded or
+# published, and it runs with read-only permissions.
+name: FreeBSD build (informational)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-freebsd:
+    name: build (freebsd-${{ matrix.release }}, ${{ matrix.arch }}, clang)
+    strategy:
+      fail-fast: false
+      matrix:
+        release: ['15.1', '14.4']
+        arch: ['x86_64']
+        # arch: ['x86_64', 'aarch64']
+        # aarch64 is disabled for now: it has not been proven with this
+        # workflow. Its earlier blocker was the frontend build (lightningcss
+        # publishes no freebsd-arm64 binary), which this headless job no
+        # longer runs. Re-enable after a green aarch64 proof run.
+        include:
+          - arch: x86_64
+            sync: rsync
+          # - arch: aarch64
+          #   sync: scp
+    # Must be an x86_64 host (ubuntu-latest). QEMU guest emulation on the arm
+    # runners (ubuntu-*-arm) degrades so badly that runs hit 3+ hour timeouts.
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Build and run inside a FreeBSD ${{ matrix.release }} (${{ matrix.arch }}) VM
+        # https://github.com/vmactions/freebsd-vm
+        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1.5.9
+        with:
+          release: ${{ matrix.release }}
+          arch: ${{ matrix.arch }}
+          # Sync options: rsync, sshfs, nfs, scp
+          sync: ${{ matrix.sync }}
+          # Nothing from the VM is used after the run, so skip the copy back.
+          copyback: false
+          mem: 6144
+          cpu: 4
+          prepare: |
+            pkg update -f
+            pkg install -y gmake sqlite3 pkgconf bash
+            which python3 >/dev/null 2>&1 || ln -sf $(which python3.15 python3.14 python3.13 python3.12 python3.11 python3.10 2>/dev/null | head -n 1) /usr/local/bin/python3
+          run: |
+            scripts/build.sh CC=clang CXX=clang++
+            build/c/codebase-memory-mcp --version

Makefile.cbm

@@ -889,7 +889,8 @@ TEST_PY_LSP_STRESS_SRCS = tests/test_py_lsp_stress.c
 TEST_PY_LSP_SCALE_SRCS = tests/test_py_lsp_scale.c
 
 TEST_TS_LSP_SRCS = tests/test_ts_lsp.c
-TEST_JAVA_LSP_SRCS = tests/test_java_lsp.c tests/test_java_lsp_coverage.c
+TEST_JAVA_LSP_SRCS = tests/test_java_lsp.c tests/test_java_lsp_coverage.c \
+	tests/test_java_typed_calls.c
 TEST_KOTLIN_LSP_SRCS = tests/test_kotlin_lsp.c tests/test_kotlin_typed_calls.c
 TEST_RUST_LSP_SRCS = tests/test_rust_lsp.c
 

README.md

@@ -162,7 +162,7 @@ To configure detected agent assets without replacing an externally managed binar
 codebase-memory-cli install --skip-binary
 ```
 
-Use `install --plan` to inspect asset writes and `install-hooks --plan` to inspect hook writes before applying either surface. `--clients=<list>` is supported independently by both commands.
+Use `install --plan` to inspect asset writes and `install-hooks --plan` to inspect hook writes before applying either surface. `--clients=<list>` is supported independently by both commands. `install --no-hooks` removes CLI-owned hooks and stores the opt-out (`config get install_hooks`); later `install`, `update`, and `install-hooks` honour it until `install --hooks` clears it.
 
 ## Installation
 

docs/CONFIGURATION.md

@@ -81,6 +81,7 @@ codebase-memory-cli config set watcher_enabled false
 codebase-memory-cli config set ignore_worktrees true
 codebase-memory-cli config set doc_candidates false
 codebase-memory-cli config reset doc_candidates
+codebase-memory-cli config get install_hooks
 ```
 
 `doc_candidates` is `auto` by default: unset, the index mode decides. A single
@@ -103,6 +104,9 @@ Current keys:
 | `index_max_source_mb` | `off` | Optional maximum accepted source size in MiB in one discovery run. |
 | `index_max_rss_mb` | `off` | Optional maximum charged memory in MiB for the complete contained index-worker process tree (`64..1048576`). On macOS this is phys_footprint, not resident size. |
 | `index_max_duration_seconds` | `off` | Optional maximum wall-clock duration in seconds for the whole index request, including crash/hang recovery (`1..86400`). Like `index_max_rss_mb`, it stops a worker only before it starts to publish the new index; see [INDEX_RESOURCE_LIMITS.md](INDEX_RESOURCE_LIMITS.md). |
+| `install_hooks` | `true` | Whether CLI-owned client hooks may be installed. `install --no-hooks` removes CLI-owned hooks and persists `false`; `install --hooks` restores `true`. |
+
+While `install_hooks` is `false`, `install`, `update`, and `install-hooks` leave CLI-owned hooks off (`install` and `update` re-remove them); user-owned hook entries are never touched. `install --hooks` only clears the opt-out; run `install-hooks` afterwards to add hooks. Skills and instructions are unaffected.
 
 > **`watcher_enabled` vs `auto_watch`.** `watcher_enabled` controls whether the
 > retained watcher subsystem starts at all. `auto_watch` is narrower: it controls

docs/upstream-sync/13m1.md

@@ -0,0 +1,8 @@
+# 13M-1 integration receipt
+
+- Upstream checkpoint: `5689ea54ceac23d7e5bf59d54b9c718b59ae9ee0`. Merge `3a4fdb9b975106489b764556823d9528681301c2` is a true merge with parents fork `cf63fe667579482c7e3b73238b73d4ad2d01db97` and upstream checkpoint `5689ea54c`; the checkpoint contains 104 commits and 11 first-parent PR merges. Follow-up head: `c3c5271ab8f454287452f0df5eca9e38ffd250cf` on `sync/upstream-13m1-20261108`.
+- Retained and adapted: upstream benchmark runtime isolation (#2198) was ported with its contract test adapted to CLI argv; #1561 added truthful index freshness to `status --verbose`; #1430 added the `ignore_worktrees` hook gate and explicit index refusal through `--index-worktree`.
+- Follow-up repairs: `3cbefe210` fixed verbose status output because `cbm_git_context_resolve` returns zero on success and the pre-existing fork path never emitted the Git object. Jenkins #89 exposed an `index_policy` fixture using `th_mktempdir`'s shared static buffer for both repo and cache roots; fork commit `19f5bdfa8`'s cache-root guard correctly refused that layout. `c3c5271ab` gave the fixture distinct roots. The failure was pre-existing on main since `19f5bdfa8`; Jenkins #89 failed at `3cbefe210` with 3,044 passed and 1 failed.
+- Verification: local build with `-Werror`, memory-core lint (3,211 raw sites), strict Actions policy, targeted tests 18/18, and `index_policy` 12/12 passed. Jenkins: release-tooling #90 SUCCESS on exact head `c3c5271ab`. Merged to main via PR #33 (merge commit `929adfe36`).
+- Native Windows was not run. No push, PR publication, or GitHub Actions dispatch occurred for this receipt.
+

docs/upstream-sync/13m2.md

@@ -0,0 +1,8 @@
+# 13M-2 integration receipt
+
+- Upstream checkpoint: `e0c7a1da6c067149716afad5a06f2465c114840d`. Merge `bff6508606c296e3d96e5a01af44a9c35ae64049` is a true merge with parents 13M-1 merge `3a4fdb9b9` and upstream checkpoint `e0c7a1da6`; the checkpoint contains 73 commits and 7 first-parent PRs. The batch integrated 13M-1 follow-ups in merges `6ec8d5873` and `1c5f82a3a`; head `1c5f82a3a340ff5fa8069e4357d3177be8c48eab` on `sync/upstream-13m2-20261108`.
+- Retained #1724 resource-worker behavior through native `src/operations/index.{c,h}` and `index_supervisor`: `RESOURCE_FAILURE` disposition, request facts, resource response, and worker publish gate. Also retained #2395 Swift initialization and #2499 memory-lint changes.
+- Exclusion: #1784 MCP frontend recovery was MCP-only because `src/daemon/frontend.c` is deleted in the CLI fork; no MCP frontend was restored.
+- Verification: local build with `-Werror`, memory-core lint (3,201 raw sites, none grew), strict Actions policy, `index_supervisor` 21/21, daemon-application resource tests 6/6, and combined related checks 5/5 passed. Jenkins: release-tooling #91 failed on `1c5f82a3a` with 2 failures, both upstream Hermes hook cycle tests (from `e8f0f4a28`) that called the assets-only installer and named the binary `codebase-memory-mcp`. `0f1927fd3` runs them through `cbm_install_agent_hooks_for_testing` with the `codebase-memory-cli` binary name. Release-tooling #93 SUCCESS on exact head `0f1927fd3`.
+- Native Windows was not run. No push, PR publication, or GitHub Actions dispatch occurred for this receipt.
+

docs/upstream-sync/13n.md

@@ -0,0 +1,7 @@
+# 13N integration receipt
+
+- Upstream checkpoint: `612eee2518ef84cc573e491fdee5fa5c90264cb5` (upstream main). Merge `2efba854891c7edbc8839c8cce0a7fb9fa7dec11` is a true merge with parents 13M-2 merge `6ec8d5873` and the exact upstream checkpoint; it contains 39 commits and 6 first-parent PRs. Follow-up `e4717235e` ports #2749 to `src/operations/source_search.c`: POSIX unscoped scans use argv `find`/`sort` stages and an in-process scan. `validate_search_args` continues to reject metacharacters in scopes and patterns, as upstream does. Merge `cf24b6a323f4944dd429820af0654bf6be29ccc0` integrated 13M-1 follow-ups. Head: `cf24b6a32` on `sync/upstream-13n-20261108`.
+- Retained #1862 install hook opt-out, #2667 Java external receiver, #2840 watcher cooldown, #2903 reserved `nul` handling, and #2911 dispatch-only FreeBSD workflow. MCP-only exclusions remain: `src/mcp/*`, `tests/test_mcp.c`, `src/daemon/frontend.*`, `tests/test_daemon_frontend.c`, `.github/workflows/pr.yml`, `.github/workflows/test-impact-artifact.yml`, and MCP registry steps in `release.yml` were not restored.
+- Verification: local build with `-Werror`, memory-core lint (3,201 raw sites, none grew), strict Actions policy, #1862 and #2840 tests 9/9, and source-search, integration, and index-policy tests 78/78 passed. Jenkins: release-tooling #92 on `cf24b6a32` was aborted because that head lacked the 13M-2 Hermes test fix. `98eab3ceb` merges 13M-2 into 13N; release-tooling #94 SUCCESS on exact head `98eab3ceb`. This ledger update lands as a docs-only commit on top.
+- Native Windows was not run; Windows-specific `nul` handling remains unverified natively. No push, PR publication, or GitHub Actions dispatch occurred for this receipt.
+

docs/upstream-sync/CONTINUE.md

@@ -1,6 +1,6 @@
 # Continuation prompt
 
-> Current 2026-11-02 continuation: the pinned target `a5b248f47272413189746589b9a2c551c6b6c5ec` is integrated by true merge `8a686f225b2c64f81c0716f3129c36c50fb10ffe` on `sync/upstream-remainder-20261102`; see [13l.md](13l.md) and [ledger.json](ledger.json). The target is an ancestor with zero upstream-only remainder. Final Jenkins qualification, independent review, and host acceptance remain open. Do not chase later upstream commits, mutate stale PRs #28/#29, push main, or dispatch GitHub Actions.
+> Current 2026-11-08 continuation: baseline fork `cf63fe667579482c7e3b73238b73d4ad2d01db97` was 214 commits behind upstream checkpoint `612eee2518ef84cc573e491fdee5fa5c90264cb5` (merge base `a5b248f47272413189746589b9a2c551c6b6c5ec`). Stacked checkpoints 13M-1, 13M-2, and 13N end at `c3c5271ab8f454287452f0df5eca9e38ffd250cf`, `1c5f82a3a340ff5fa8069e4357d3177be8c48eab`, and `cf24b6a323f4944dd429820af0654bf6be29ccc0`; 13N is zero upstream commits behind. See [13m1.md](13m1.md), [13m2.md](13m2.md), [13n.md](13n.md), and [ledger.json](ledger.json). Jenkins qualification is pending for all three exact heads; native Windows was not run. Independent review and host acceptance remain separate gates. No push, PR publication, or GitHub Actions dispatch occurred.
 
 Continue the 2026-11-01 CLI-first upstream campaign. Read PLAN.md, ledger.json,
 13a.md and the canonical ../UPSTREAM_308_CANDIDATE_AUDIT_20260912.md first.

docs/upstream-sync/PLAN.md

@@ -2,14 +2,14 @@
 
 ## Live continuation — 2026-11-02
 
-13A is on the authoritative fork main at `27b731cec45e2353303738ac6d8e77acbef42b7c`.
-The pinned continuation target is `a5b248f47272413189746589b9a2c551c6b6c5ec`.
-13B–13L are integrated provisionally in order. The final 13L merge is
-`8a686f225b2c64f81c0716f3129c36c50fb10ffe` with receipt [13l.md](13l.md); the
-pinned target is now an ancestor and no pinned upstream commits remain. Independent
-review, final Jenkins qualification, and host acceptance remain open. Current state is in
-[ledger.json](ledger.json); older campaign inventory and PR bases below are
-historical, and do not override the continuation run contract.
+13A–13L are historical checkpoints. The 2026-11-08 stacked continuation integrates
+13M-1, 13M-2, and 13N, ending at `98eab3ceb0666aee5521745414f5199acacba315`;
+the pinned upstream main `612eee2518ef84cc573e491fdee5fa5c90264cb5` is an ancestor
+with zero upstream-only commits. See [13m1.md](13m1.md), [13m2.md](13m2.md),
+[13n.md](13n.md), and [ledger.json](ledger.json). Jenkins full gate passed for exact heads
+`c3c5271ab` (#90, merged as PR #33), `0f1927fd3` (#93), and `98eab3ceb` (#94); native Windows was not run.
+Independent review and host acceptance remain open. Older campaign inventory and
+PR bases below are historical and do not override the continuation run contract.
 
 This campaign supplements the [canonical integration ledger](../UPSTREAM_308_CANDIDATE_AUDIT_20260912.md); it does not supersede older unresolved semantic dispositions. Machine status and per-checkpoint acceptance live in [ledger.json](ledger.json). [commits.tsv](commits.tsv) enumerates all 933 reachable campaign commits once, including 578 merges and 355 non-merges. Subsystem tags derive from changed paths; they are triage, not proof of implementation.
 
@@ -30,7 +30,7 @@ This campaign supplements the [canonical integration ledger](../UPSTREAM_308_CAN
 1. Finish narrow security/dependency fixes and verify actual advisories, versions and fork applicability. Preserve installer download/extraction limits and explicit workspace authorization.
 2. Harden the local/Jenkins Actions policy guard and add ancestry verification with positive/negative checks.
 3. Complete true merge of upstream `5dc83ac9fa363d51706a70977840b61ea59ce9db` (13A, 79 commits); reconcile reviewed hotfix/guard commits, retaining upstream merge ancestry. Publish only sanitized draft branches.
-4. Batches 13E–13L build sequentially on the latest provisional checkpoint. They remain dependent and unaccepted until independent review. Publish only sanitized stacked draft PRs with explicit dependencies; never base them on stale main.
+4. Batches 13E–13N build sequentially on the latest provisional checkpoint. They remain dependent and unaccepted until independent review. Publish only sanitized stacked draft PRs with explicit dependencies; never base them on stale main.
 5. Run focused checks after each completed batch, then full exact-SHA Jenkins qualification before recommending merge. Native Windows, >4 GiB SQLite offsets, graph determinism and sanitizer/recovery checks remain explicit gates when affected. Pending gates are not successful gates.
 
 Every batch must preserve CLI JSON/compact contracts, native HTTP, daemon ownership, durable storage and source provenance. No MCP server, transport/session registration or mandatory MCP dependencies. Retain useful shared changes via native CLI operations. Record every material exclusion/adaptation and schema migration in its batch receipt.