feat: coordinate concurrent CBM sessions

.github/workflows/_build.yml

@@ -170,11 +170,15 @@ jobs:
       - name: Archive standard binary
         shell: msys2 {0}
         run: |
-          BIN=build/c/codebase-memory-mcp
-          [ -f "${BIN}.exe" ] && BIN="${BIN}.exe"
-          cp "$BIN" codebase-memory-mcp.exe
+          make -f Makefile.cbm build/c/codebase-memory-mcp-launcher.exe CC=clang CXX=clang++
+          PAYLOAD=build/c/codebase-memory-mcp
+          [ -f "${PAYLOAD}.exe" ] && PAYLOAD="${PAYLOAD}.exe"
+          cp build/c/codebase-memory-mcp-launcher.exe codebase-memory-mcp.exe
+          cp "$PAYLOAD" codebase-memory-mcp.payload.exe
           scripts/gen-third-party-notices.sh THIRD_PARTY_NOTICES.md
-          zip codebase-memory-mcp-windows-amd64.zip codebase-memory-mcp.exe LICENSE install.ps1 THIRD_PARTY_NOTICES.md
+          zip codebase-memory-mcp-windows-amd64.zip \
+            codebase-memory-mcp.exe codebase-memory-mcp.payload.exe \
+            LICENSE install.ps1 THIRD_PARTY_NOTICES.md
 
       - name: Attest standard binary provenance
         if: ${{ inputs.attest }}
@@ -196,11 +200,15 @@ jobs:
       - name: Archive UI binary
         shell: msys2 {0}
         run: |
-          BIN=build/c/codebase-memory-mcp
-          [ -f "${BIN}.exe" ] && BIN="${BIN}.exe"
-          cp "$BIN" codebase-memory-mcp.exe
+          make -f Makefile.cbm build/c/codebase-memory-mcp-launcher.exe CC=clang CXX=clang++
+          PAYLOAD=build/c/codebase-memory-mcp
+          [ -f "${PAYLOAD}.exe" ] && PAYLOAD="${PAYLOAD}.exe"
+          cp build/c/codebase-memory-mcp-launcher.exe codebase-memory-mcp.exe
+          cp "$PAYLOAD" codebase-memory-mcp.payload.exe
           scripts/gen-third-party-notices.sh THIRD_PARTY_NOTICES.md
-          zip codebase-memory-mcp-ui-windows-amd64.zip codebase-memory-mcp.exe LICENSE install.ps1 THIRD_PARTY_NOTICES.md
+          zip codebase-memory-mcp-ui-windows-amd64.zip \
+            codebase-memory-mcp.exe codebase-memory-mcp.payload.exe \
+            LICENSE install.ps1 THIRD_PARTY_NOTICES.md
 
       - name: Attest UI binary provenance
         if: ${{ inputs.attest }}
@@ -251,11 +259,15 @@ jobs:
       - name: Archive standard binary
         shell: msys2 {0}
         run: |
-          BIN=build/c/codebase-memory-mcp
-          [ -f "${BIN}.exe" ] && BIN="${BIN}.exe"
-          cp "$BIN" codebase-memory-mcp.exe
+          make -f Makefile.cbm build/c/codebase-memory-mcp-launcher.exe CC=clang CXX=clang++
+          PAYLOAD=build/c/codebase-memory-mcp
+          [ -f "${PAYLOAD}.exe" ] && PAYLOAD="${PAYLOAD}.exe"
+          cp build/c/codebase-memory-mcp-launcher.exe codebase-memory-mcp.exe
+          cp "$PAYLOAD" codebase-memory-mcp.payload.exe
           scripts/gen-third-party-notices.sh THIRD_PARTY_NOTICES.md
-          zip codebase-memory-mcp-windows-arm64.zip codebase-memory-mcp.exe LICENSE install.ps1 THIRD_PARTY_NOTICES.md
+          zip codebase-memory-mcp-windows-arm64.zip \
+            codebase-memory-mcp.exe codebase-memory-mcp.payload.exe \
+            LICENSE install.ps1 THIRD_PARTY_NOTICES.md
 
       - name: Attest standard binary provenance
         if: ${{ inputs.attest }}
@@ -277,11 +289,15 @@ jobs:
       - name: Archive UI binary
         shell: msys2 {0}
         run: |
-          BIN=build/c/codebase-memory-mcp
-          [ -f "${BIN}.exe" ] && BIN="${BIN}.exe"
-          cp "$BIN" codebase-memory-mcp.exe
+          make -f Makefile.cbm build/c/codebase-memory-mcp-launcher.exe CC=clang CXX=clang++
+          PAYLOAD=build/c/codebase-memory-mcp
+          [ -f "${PAYLOAD}.exe" ] && PAYLOAD="${PAYLOAD}.exe"
+          cp build/c/codebase-memory-mcp-launcher.exe codebase-memory-mcp.exe
+          cp "$PAYLOAD" codebase-memory-mcp.payload.exe
           scripts/gen-third-party-notices.sh THIRD_PARTY_NOTICES.md
-          zip codebase-memory-mcp-ui-windows-arm64.zip codebase-memory-mcp.exe LICENSE install.ps1 THIRD_PARTY_NOTICES.md
+          zip codebase-memory-mcp-ui-windows-arm64.zip \
+            codebase-memory-mcp.exe codebase-memory-mcp.payload.exe \
+            LICENSE install.ps1 THIRD_PARTY_NOTICES.md
 
       - name: Attest UI binary provenance
         if: ${{ inputs.attest }}

.github/workflows/_smoke.yml

@@ -139,6 +139,7 @@ jobs:
         run: scripts/smoke-test.sh ./codebase-memory-mcp
         env:
           SMOKE_DOWNLOAD_URL: http://localhost:18080
+          SMOKE_UPDATE_FIXTURE_DIR: /tmp/smoke-server
 
       - name: Security audits
         run: |
@@ -210,17 +211,27 @@ jobs:
           SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
           ARCH=${{ matrix.arch }}
           unzip -o "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip"
-          [ -n "$SUFFIX" ] && cp "codebase-memory-mcp${SUFFIX}.exe" codebase-memory-mcp.exe || true
+          test -s codebase-memory-mcp.exe
+          test -s codebase-memory-mcp.payload.exe
+          PROFILE_ROOT="$(cygpath -u "$USERPROFILE")"
+          LAUNCH_DIR="$(mktemp -d "$PROFILE_ROOT/cbm-release-version.XXXXXX")"
+          trap 'rm -rf "$LAUNCH_DIR"' EXIT
+          cp codebase-memory-mcp.exe codebase-memory-mcp.payload.exe "$LAUNCH_DIR/"
+          "$LAUNCH_DIR/codebase-memory-mcp.payload.exe" --version
+          "$LAUNCH_DIR/codebase-memory-mcp.exe" --version
 
       - name: Start artifact server
         shell: msys2 {0}
         run: |
           mkdir -p /tmp/smoke-server
-          cp codebase-memory-mcp.exe /tmp/smoke-server/
+          cp codebase-memory-mcp.exe codebase-memory-mcp.payload.exe \
+            LICENSE install.ps1 THIRD_PARTY_NOTICES.md /tmp/smoke-server/
           SUFFIX=${{ matrix.variant == 'ui' && '-ui' || '' }}
           ARCH=${{ matrix.arch }}
           cd /tmp/smoke-server
-          zip -q "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip" codebase-memory-mcp.exe
+          zip -q "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip" \
+            codebase-memory-mcp.exe codebase-memory-mcp.payload.exe \
+            LICENSE install.ps1 THIRD_PARTY_NOTICES.md
           if [ -n "$SUFFIX" ]; then
             cp "codebase-memory-mcp${SUFFIX}-windows-${ARCH}.zip" "codebase-memory-mcp-windows-${ARCH}.zip"
           fi
@@ -232,35 +243,51 @@ jobs:
 
       - name: Smoke test
         shell: msys2 {0}
-        run: scripts/smoke-test.sh ./codebase-memory-mcp.exe
+        run: |
+          PROFILE_ROOT="$(cygpath -u "$USERPROFILE")"
+          SMOKE_DIR="$(mktemp -d "$PROFILE_ROOT/cbm-release-smoke.XXXXXX")"
+          trap 'rm -rf "$SMOKE_DIR"' EXIT
+          cp codebase-memory-mcp.exe codebase-memory-mcp.payload.exe "$SMOKE_DIR/"
+          CBM_CACHE_DIR="$(cygpath -m "$SMOKE_DIR/cache")" \
+            SMOKE_TEMP_ROOT="$SMOKE_DIR" \
+            scripts/smoke-test.sh "$SMOKE_DIR/codebase-memory-mcp.exe"
         env:
           SMOKE_DOWNLOAD_URL: http://127.0.0.1:18080
+          SMOKE_UPDATE_FIXTURE_DIR: /tmp/smoke-server
           SMOKE_ARCH: ${{ matrix.arch }}
 
       - name: Security audits
         shell: msys2 {0}
         run: |
           scripts/security-strings.sh ./codebase-memory-mcp.exe
-          scripts/security-install.sh ./codebase-memory-mcp.exe
+          scripts/security-strings.sh ./codebase-memory-mcp.payload.exe
+          PROFILE_ROOT="$(cygpath -u "$USERPROFILE")"
+          SECURITY_DIR="$(mktemp -d "$PROFILE_ROOT/cbm-release-security.XXXXXX")"
+          trap 'rm -rf "$SECURITY_DIR"' EXIT
+          cp codebase-memory-mcp.exe codebase-memory-mcp.payload.exe "$SECURITY_DIR/"
+          TMPDIR="$SECURITY_DIR" \
+            scripts/security-install.sh "$SECURITY_DIR/codebase-memory-mcp.exe"
 
       - name: Windows Defender scan
         shell: pwsh
         run: |
           & "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate 2>$null
-          $result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$PWD\codebase-memory-mcp.exe" -DisableRemediation
-          $code = $LASTEXITCODE
-          Write-Host $result
-          # MpCmdRun -Scan exit codes: 0 = clean, 2 = threat found. Any OTHER non-zero
-          # means the scan engine could not run at all (e.g. hr=0x800106ba: the Defender
-          # antimalware service is unavailable on the runner) — that is NOT a detection.
-          # Fail soft on an engine failure so a transient runner-side AV outage can't
-          # false-fail a release; only a real detection (exit 2) hard-blocks.
-          if ($code -eq 2) {
-            Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1
-          } elseif ($code -ne 0) {
-            Write-Host "::warning::Windows Defender scan could not run (exit $code) - skipping AV gate on this runner"
-          } else {
-            Write-Host "=== Windows Defender: clean ==="
+          foreach ($binary in @("codebase-memory-mcp.exe", "codebase-memory-mcp.payload.exe")) {
+            $result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$PWD\$binary" -DisableRemediation
+            $code = $LASTEXITCODE
+            Write-Host $result
+            # MpCmdRun -Scan exit codes: 0 = clean, 2 = threat found. Any OTHER non-zero
+            # means the scan engine could not run at all (e.g. hr=0x800106ba: the Defender
+            # antimalware service is unavailable on the runner) — that is NOT a detection.
+            # Fail soft on an engine failure so a transient runner-side AV outage can't
+            # false-fail a release; only a real detection (exit 2) hard-blocks.
+            if ($code -eq 2) {
+              Write-Host "BLOCKED: Windows Defender flagged $binary!"; exit 1
+            } elseif ($code -ne 0) {
+              Write-Host "::warning::Windows Defender scan could not run for $binary (exit $code) - skipping AV gate on this runner"
+            } else {
+              Write-Host "=== Windows Defender: $binary clean ==="
+            }
           }
 
   smoke-linux-portable:

.github/workflows/_test.yml

@@ -81,12 +81,39 @@ jobs:
 
       - name: Install deps (Ubuntu)
         if: startsWith(matrix.os, 'ubuntu')
-        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
+        run: sudo apt-get update && sudo apt-get install -y zlib1g-dev ccache
+
+      - name: Install ccache (macOS)
+        if: startsWith(matrix.os, 'macos')
+        run: command -v ccache >/dev/null 2>&1 || brew install ccache
+
+      # Verified compiler cache: CCACHE_COMPILERCHECK=content keys every entry
+      # on the compiler-binary CONTENT plus the fully preprocessed input, so a
+      # hit is provably the identical compilation — a stale or foreign cache
+      # can only miss, never return wrong output (see scripts/env.sh).
+      # Keys embed github.ref on top of GitHub's own branch scoping: caches are
+      # STRICTLY per-ref by policy — no base-branch fallback, a new PR builds
+      # cold once and only its own pushes warm it.
+      - name: Compiler cache (content-verified)
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ github.workspace }}/.ccache
+          key: ccache-test-${{ matrix.os }}-${{ matrix.cc }}-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            ccache-test-${{ matrix.os }}-${{ matrix.cc }}-${{ github.ref }}-
 
       - name: Test
         run: scripts/test.sh CC=${{ matrix.cc }} CXX=${{ matrix.cxx }}
         env:
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          CCACHE_MAXSIZE: 1500M
+
+      - name: ccache stats
+        if: always()
+        run: ccache -s || true
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
 
   test-tsan:
     runs-on: ubuntu-latest
@@ -95,10 +122,33 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install deps (Ubuntu)
-        run: sudo apt-get update && sudo apt-get install -y clang zlib1g-dev
+        run: sudo apt-get update && sudo apt-get install -y clang zlib1g-dev ccache
+
+      - name: Compiler cache (content-verified)
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ github.workspace }}/.ccache
+          key: ccache-tsan-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            ccache-tsan-${{ github.ref }}-
 
       - name: ThreadSanitizer tests
-        run: make -f Makefile.cbm test-tsan CC=clang CXX=clang++
+        # This job calls make directly (no env.sh), so route the compilers
+        # through ccache's Debian masquerade dir; update-ccache-symlinks in the
+        # ccache postinst has already linked the clang installed above.
+        run: |
+          export PATH=/usr/lib/ccache:$PATH
+          export CCACHE_COMPILERCHECK=content
+          make -f Makefile.cbm test-tsan CC=clang CXX=clang++
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          CCACHE_MAXSIZE: 1500M
+
+      - name: ccache stats
+        if: always()
+        run: ccache -s || true
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
 
   test-windows:
     needs: setup-matrix
@@ -119,9 +169,42 @@ jobs:
             mingw-w64-clang-${{ matrix.pkg }}-clang
             mingw-w64-clang-${{ matrix.pkg }}-compiler-rt
             mingw-w64-clang-${{ matrix.pkg }}-zlib
+            mingw-w64-clang-${{ matrix.pkg }}-ccache
             make
             git
 
+      - name: Create protected per-user temp root
+        # The daemon suites fail closed on the MSYS-shared /tmp and on the
+        # runner's inherited LocalAppData\Temp ACLs. Give the whole harness a
+        # per-user root under the profile with an owner-stamped, protected
+        # current-SID DACL, matching the launcher/daemon trust policy.
+        shell: pwsh
+        run: |
+          $root = Join-Path $env:USERPROFILE ("cbm-ci-tmp-" + [guid]::NewGuid().ToString("N"))
+          New-Item -ItemType Directory -Path $root | Out-Null
+          $sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+          $acl = [System.Security.AccessControl.DirectorySecurity]::new()
+          $acl.SetOwner($sid)
+          $acl.SetAccessRuleProtection($true, $false)
+          $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+            $sid,
+            [System.Security.AccessControl.FileSystemRights]::FullControl,
+            ([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+              [System.Security.AccessControl.InheritanceFlags]::ObjectInherit),
+            [System.Security.AccessControl.PropagationFlags]::None,
+            [System.Security.AccessControl.AccessControlType]::Allow)
+          $acl.AddAccessRule($rule) | Out-Null
+          Set-Acl -LiteralPath $root -AclObject $acl
+          "CBM_CI_TEMP_ROOT=$root" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
+      - name: Compiler cache (content-verified)
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ github.workspace }}/.ccache
+          key: ccache-test-${{ matrix.os }}-${{ matrix.msystem }}-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            ccache-test-${{ matrix.os }}-${{ matrix.msystem }}-${{ github.ref }}-
+
       - name: Test
         shell: msys2 {0}
         # AddressSanitizer is unavailable on native ARM64 Windows (LLVM ships no
@@ -130,9 +213,25 @@ jobs:
         # native ARM64 build with SANITIZE= (no sanitizer) — still a real
         # functional gate. ASan/UBSan coverage comes from the other 9 legs,
         # including native-ARM Linux/macOS. x86-64 Windows keeps full sanitizers.
-        run: scripts/test.sh CC=clang CXX=clang++ ${{ matrix.os == 'windows-11-arm' && 'SANITIZE=' || '' }}
+        run: |
+          # Native tests resolve temp via TEMP/TMP (cbm_tmpdir); shell tools use
+          # TMPDIR. Route both through the protected root created above so no
+          # fixture lands under a shared or ACL-inherited ancestry.
+          export TEMP="$(cygpath -m "$CBM_CI_TEMP_ROOT")"
+          export TMP="$TEMP"
+          export TMPDIR="$(cygpath -u "$CBM_CI_TEMP_ROOT")"
+          scripts/test.sh CC=clang CXX=clang++ ${{ matrix.os == 'windows-11-arm' && 'SANITIZE=' || '' }}
         env:
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          CCACHE_MAXSIZE: 1500M
+
+      - name: ccache stats
+        if: always()
+        shell: msys2 {0}
+        run: ccache -s || true
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
 
   # Windows product-surface regression guards. Distinct from test-windows above
   # (the sanitizer C suite): these drive a real product binary + embedded HTTP UI
@@ -155,18 +254,34 @@ jobs:
           install: >-
             mingw-w64-clang-x86_64-clang
             mingw-w64-clang-x86_64-zlib
+            mingw-w64-clang-x86_64-ccache
             make
             git
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22"
 
+      - name: Test npm wrapper failure handling
+        working-directory: pkg/npm
+        run: npm test
+
+      - name: Compiler cache (content-verified)
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ github.workspace }}/.ccache
+          key: ccache-guards-${{ github.ref }}-${{ github.sha }}
+          restore-keys: |
+            ccache-guards-${{ github.ref }}-
+
       - name: Build product binary with embedded UI
         shell: msys2 {0}
         # --with-ui builds the frontend (npm) and embeds it, so the drive-picker
         # guard's HTTP UI is available. Functional gate only (no sanitizers).
         run: scripts/build.sh --with-ui CC=clang CXX=clang++
+        env:
+          CCACHE_DIR: ${{ github.workspace }}/.ccache
+          CCACHE_MAXSIZE: 1500M
 
       - name: Windows regression guards (#636/#357, #618, #548, #423/#20)
         shell: pwsh