From 3e19065085232ba5b7aa7f1a4ad4a67d66a43100 Mon Sep 17 00:00:00 2001 From: Selfish666420 Date: Tue, 14 Jul 2026 05:10:47 -0700 Subject: [PATCH 1/2] Add Copilot guide and harden installer - add repo-specific Copilot instructions under .github\n- harden install.sh arg parsing, checksum handling, and Windows binary install\n- align test-infrastructure Dockerfile comment with actual deps\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: Selfish666420 --- .github/copilot-instructions.md | 72 +++++++++++++++++++++++++++++++++ install.sh | 36 ++++++++++++++--- test-infrastructure/Dockerfile | 2 +- 3 files changed, 104 insertions(+), 6 deletions(-) create mode 100644 .github/copilot-instructions.md diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 100644 index 000000000..a7bb149ea --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1,72 @@ +# codebase-memory-mcp Copilot instructions + +## Build, test, and lint commands + +Use the scripts in `scripts/` as the canonical entrypoints (they are used by CI and wrap the Makefile correctly). + +```bash +# Build (default production binary) +scripts/build.sh + +# Build with embedded graph UI assets +scripts/build.sh --with-ui + +# Run full C test suite (ASan + UBSan build) +scripts/test.sh + +# Run one/few suites only (suite names come from tests/test_main.c) +make -f Makefile.cbm test-focused TEST_SUITES="pipeline" +make -f Makefile.cbm test-focused TEST_SUITES="mcp store_nodes" + +# Fast foundation-only tests +make -f Makefile.cbm test-foundation + +# ThreadSanitizer run (default suites: mem slab_alloc parallel) +make -f Makefile.cbm test-tsan CC=clang CXX=clang++ + +# Lint (full local lint: clang-tidy + cppcheck + clang-format) +scripts/lint.sh + +# CI-style lint (no clang-tidy) +scripts/lint.sh --ci + +# Security audit suite +make -f Makefile.cbm security +``` + +UI frontend-only build path used by `cbm-with-ui`: + +```bash +cd graph-ui && npm ci && npm run build +``` + +## High-level architecture + +- **Single C binary, two operating modes**: + - `codebase-memory-mcp` (no subcommand): MCP JSON-RPC server over stdio (`src/main.c` + `src/mcp/mcp.c`) + - `codebase-memory-mcp cli ...`: one-shot tool execution path (`run_cli` in `src/main.c`) +- **Pipeline orchestrator (`src/pipeline/pipeline.c`)**: + 1. discover files + 2. build structural nodes + 3. run extraction/resolution (sequential or parallel depending on file count/worker count) + 4. run post passes (tests/history/predump) + 5. dump graph to SQLite and persist hashes/artifacts +- **Graph persistence layer (`src/store/store.c`)**: SQLite-backed graph store with prepared-statement caching, schema/init, node/edge/project/file-hash operations, and search/traversal queries. +- **Language extraction stack**: + - `internal/cbm/`: tree-sitter extraction, language specs, LSP-style resolvers, vendored grammar/runtime code + - `src/pipeline/pass_*.c`: pass-level graph construction and enrichment +- **CLI installation/config surface (`src/cli/*.c`)**: install/update/uninstall/config plus agent config/instruction/profile wiring across many client surfaces. + +## Key conventions + +- **Pure C codebase**: this project was rewritten from Go; implementation changes are expected in C (see `CONTRIBUTING.md`). +- **Use script entrypoints, not ad-hoc make recipes**: `scripts/build.sh`, `scripts/test.sh`, and `scripts/lint.sh` are the maintained source of truth and handle env/arch/compiler wiring consistently. +- **When adding/changing pipeline passes, keep sequential and parallel paths aligned**: + - sequential pass list is in `run_sequential_pipeline()` (`src/pipeline/pipeline.c`) + - parallel flow is in `run_parallel_pipeline()` and related parallel helpers + - if logic exists in only one path, behavior diverges by repo size/worker config. +- **Focused test runs use suite names from `tests/test_main.c`** via `TEST_SUITES="..."`; this runner supports multiple suite names in one invocation. +- **Strict lint suppression policy**: only `NOLINT(misc-no-recursion)` is allowed, and only for whitelisted functions (`Makefile.cbm` + `src/foundation/recursion_whitelist.h`). +- **No-skips policy for tests**: lint checks enforce that tests should pass/fail rather than generic skips (`scripts/check-no-test-skips.sh`). +- **Security-sensitive calls are allowlisted**: additions like `system()`, `popen()`, `fork()`, or new network calls must be justified and reflected in `scripts/security-allowlist.txt`. +- **Contribution workflow conventions from repo docs**: enable repo hooks (`git config core.hooksPath scripts/hooks`) and use DCO sign-off commits (`git commit -s`). diff --git a/install.sh b/install.sh index d0678011d..a88cdacac 100755 --- a/install.sh +++ b/install.sh @@ -50,9 +50,19 @@ prev="" for arg in "$@"; do if [ "$prev" = "--dir" ]; then INSTALL_DIR="$arg" + prev="" + continue + fi + if [ "$arg" = "--dir" ]; then + prev="--dir" + else + prev="" fi - prev="$arg" done +if [ "$prev" = "--dir" ]; then + echo "error: --dir requires a path argument" >&2 + exit 1 +fi detect_os() { case "$(uname -s)" in @@ -82,12 +92,14 @@ detect_arch() { OS=$(detect_os) ARCH=$(detect_arch) +BIN_NAME="codebase-memory-mcp" +[ "$OS" = "windows" ] && BIN_NAME="${BIN_NAME}.exe" echo "codebase-memory-mcp installer" echo " os: $OS" echo " arch: $ARCH" echo " variant: $VARIANT" -echo " target: $INSTALL_DIR/codebase-memory-mcp" +echo " target: $INSTALL_DIR/$BIN_NAME" echo "" # Build download URL @@ -127,8 +139,19 @@ fi # Checksum verification CHECKSUM_URL="${CBM_DOWNLOAD_URL}/checksums.txt" -if curl -fsSL -o "$DLDIR/checksums.txt" "$CHECKSUM_URL" 2>/dev/null; then - EXPECTED=$(grep "$ARCHIVE" "$DLDIR/checksums.txt" | awk '{print $1}') +CHECKSUM_READY=false +if command -v curl &>/dev/null; then + if curl -fsSL -o "$DLDIR/checksums.txt" "$CHECKSUM_URL" 2>/dev/null; then + CHECKSUM_READY=true + fi +elif command -v wget &>/dev/null; then + if wget -q -O "$DLDIR/checksums.txt" "$CHECKSUM_URL" 2>/dev/null; then + CHECKSUM_READY=true + fi +fi + +if [ "$CHECKSUM_READY" = true ]; then + EXPECTED=$(awk -v f="$ARCHIVE" '{name=$2; sub(/^\*/, "", name); if (name == f) {print $1; exit}}' "$DLDIR/checksums.txt") if [ -n "$EXPECTED" ]; then if command -v sha256sum &>/dev/null; then ACTUAL=$(sha256sum "$DLDIR/$ARCHIVE" | awk '{print $1}') @@ -158,6 +181,9 @@ else fi DLBIN="$DLDIR/codebase-memory-mcp" +if [ "$OS" = "windows" ] && [ ! -f "$DLBIN" ] && [ -f "$DLDIR/codebase-memory-mcp.exe" ]; then + DLBIN="$DLDIR/codebase-memory-mcp.exe" +fi if [ ! -f "$DLBIN" ]; then echo "error: binary not found after extraction" >&2 exit 1 @@ -172,7 +198,7 @@ fi # Install mkdir -p "$INSTALL_DIR" -DEST="$INSTALL_DIR/codebase-memory-mcp" +DEST="$INSTALL_DIR/$BIN_NAME" if [ -f "$DEST" ]; then rm -f "$DEST" fi diff --git a/test-infrastructure/Dockerfile b/test-infrastructure/Dockerfile index 444b413f3..5a4b96a75 100644 --- a/test-infrastructure/Dockerfile +++ b/test-infrastructure/Dockerfile @@ -1,7 +1,7 @@ # Mirrors the Ubuntu CI environment exactly: # - Ubuntu 24.04 (same as GitHub Actions ubuntu-latest / ubuntu-24.04-arm) # - GCC (system default) with ASan + UBSan + LeakSanitizer -# - libsqlite3-dev + zlib1g-dev (same as CI "Install deps" step) +# - zlib1g-dev (sqlite3 is vendored in this repo) # # Build: docker build -t cbm-test test-infrastructure/ # Run: docker run --rm -v $(pwd):/src cbm-test From ff776faf0b3bf00e9312e4b92755123d1369d3e6 Mon Sep 17 00:00:00 2001 From: Selfish666420 Date: Tue, 14 Jul 2026 23:05:38 -0700 Subject: [PATCH 2/2] Narrow PR to installer hardening Revert unrelated documentation-only changes so this PR focuses only on install.sh reliability fixes. Signed-off-by: Selfish666420 --- .github/copilot-instructions.md | 72 --------------------------------- test-infrastructure/Dockerfile | 2 +- 2 files changed, 1 insertion(+), 73 deletions(-) delete mode 100644 .github/copilot-instructions.md diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md deleted file mode 100644 index a7bb149ea..000000000 --- a/.github/copilot-instructions.md +++ /dev/null @@ -1,72 +0,0 @@ -# codebase-memory-mcp Copilot instructions - -## Build, test, and lint commands - -Use the scripts in `scripts/` as the canonical entrypoints (they are used by CI and wrap the Makefile correctly). - -```bash -# Build (default production binary) -scripts/build.sh - -# Build with embedded graph UI assets -scripts/build.sh --with-ui - -# Run full C test suite (ASan + UBSan build) -scripts/test.sh - -# Run one/few suites only (suite names come from tests/test_main.c) -make -f Makefile.cbm test-focused TEST_SUITES="pipeline" -make -f Makefile.cbm test-focused TEST_SUITES="mcp store_nodes" - -# Fast foundation-only tests -make -f Makefile.cbm test-foundation - -# ThreadSanitizer run (default suites: mem slab_alloc parallel) -make -f Makefile.cbm test-tsan CC=clang CXX=clang++ - -# Lint (full local lint: clang-tidy + cppcheck + clang-format) -scripts/lint.sh - -# CI-style lint (no clang-tidy) -scripts/lint.sh --ci - -# Security audit suite -make -f Makefile.cbm security -``` - -UI frontend-only build path used by `cbm-with-ui`: - -```bash -cd graph-ui && npm ci && npm run build -``` - -## High-level architecture - -- **Single C binary, two operating modes**: - - `codebase-memory-mcp` (no subcommand): MCP JSON-RPC server over stdio (`src/main.c` + `src/mcp/mcp.c`) - - `codebase-memory-mcp cli ...`: one-shot tool execution path (`run_cli` in `src/main.c`) -- **Pipeline orchestrator (`src/pipeline/pipeline.c`)**: - 1. discover files - 2. build structural nodes - 3. run extraction/resolution (sequential or parallel depending on file count/worker count) - 4. run post passes (tests/history/predump) - 5. dump graph to SQLite and persist hashes/artifacts -- **Graph persistence layer (`src/store/store.c`)**: SQLite-backed graph store with prepared-statement caching, schema/init, node/edge/project/file-hash operations, and search/traversal queries. -- **Language extraction stack**: - - `internal/cbm/`: tree-sitter extraction, language specs, LSP-style resolvers, vendored grammar/runtime code - - `src/pipeline/pass_*.c`: pass-level graph construction and enrichment -- **CLI installation/config surface (`src/cli/*.c`)**: install/update/uninstall/config plus agent config/instruction/profile wiring across many client surfaces. - -## Key conventions - -- **Pure C codebase**: this project was rewritten from Go; implementation changes are expected in C (see `CONTRIBUTING.md`). -- **Use script entrypoints, not ad-hoc make recipes**: `scripts/build.sh`, `scripts/test.sh`, and `scripts/lint.sh` are the maintained source of truth and handle env/arch/compiler wiring consistently. -- **When adding/changing pipeline passes, keep sequential and parallel paths aligned**: - - sequential pass list is in `run_sequential_pipeline()` (`src/pipeline/pipeline.c`) - - parallel flow is in `run_parallel_pipeline()` and related parallel helpers - - if logic exists in only one path, behavior diverges by repo size/worker config. -- **Focused test runs use suite names from `tests/test_main.c`** via `TEST_SUITES="..."`; this runner supports multiple suite names in one invocation. -- **Strict lint suppression policy**: only `NOLINT(misc-no-recursion)` is allowed, and only for whitelisted functions (`Makefile.cbm` + `src/foundation/recursion_whitelist.h`). -- **No-skips policy for tests**: lint checks enforce that tests should pass/fail rather than generic skips (`scripts/check-no-test-skips.sh`). -- **Security-sensitive calls are allowlisted**: additions like `system()`, `popen()`, `fork()`, or new network calls must be justified and reflected in `scripts/security-allowlist.txt`. -- **Contribution workflow conventions from repo docs**: enable repo hooks (`git config core.hooksPath scripts/hooks`) and use DCO sign-off commits (`git commit -s`). diff --git a/test-infrastructure/Dockerfile b/test-infrastructure/Dockerfile index 5a4b96a75..444b413f3 100644 --- a/test-infrastructure/Dockerfile +++ b/test-infrastructure/Dockerfile @@ -1,7 +1,7 @@ # Mirrors the Ubuntu CI environment exactly: # - Ubuntu 24.04 (same as GitHub Actions ubuntu-latest / ubuntu-24.04-arm) # - GCC (system default) with ASan + UBSan + LeakSanitizer -# - zlib1g-dev (sqlite3 is vendored in this repo) +# - libsqlite3-dev + zlib1g-dev (same as CI "Install deps" step) # # Build: docker build -t cbm-test test-infrastructure/ # Run: docker run --rm -v $(pwd):/src cbm-test