DeusData/codebase-memory-mcp v0.10.0

on GitHub

What's Changed

• packaging: opt into the UI build via CBM_VARIANT=ui on npm and PyPI by @DeusData in #957
• feat(index): best-effort parse-coverage signal — flag not-fully-indexed files by @DeusData in #968
• feat(index): by-design coverage class — deliberately-ignored files reported as purposely not indexed by @DeusData in #974
• chore(ci): attest release artifacts in build workflow by @DeusData in #970
• ci(smoke): fail soft when the Windows Defender scan engine can't run by @DeusData in #959
• mcp: make cbm_path_within_root parseable without the preprocessor by @DeusData in #960
• ci: wire the test-tsan target by @dpersek in #890
• docs(eval-plan): mark Appendix A chapters as drafts pending ground-truth regen by @DeusData in #981
• fix(cypher): apply distinct before return limits by @pcristin in #906
• fix(artifact): put binary macro before merge=ours in generated .gitattributes by @alex-plosceac in #916
• fix(lsp/php): prevent OOM when a PHP trait uses itself by @muba00 in #920
• fix(pipeline): classify native fetch() as HTTP_CALLS, not local shadows by @apappas1129 in #927
• test(mcp): cover CLI index_repository name override by @blankanswer in #948
• fix(windows): read search_code temp files as UTF-8 by @Cosm1cAC in #956
• Add Mojo language wiring by @aaiyer in #939
• feat(mem): pure resolver + strict parse + clamp for CBM_MEM_BUDGET_MB by @yangsec888 in #954
• docs: add project to CLI examples by @blankanswer in #947
• fix(registry): resolve aliased direct-symbol imports in import_map (#875) by @LA-10 in #979
• Fix tools/list default pagination for non-paginating clients by @dpersek in #980
• fix(pipeline): guard env-access CONFIGURES and throws sources against… by @Dhruvy0804 in #982
• feat(perl-lsp): Perl LSP-tier semantic resolution (Closes #459) by @halindrome in #461
• test(php-lsp): regression guards for aliased-trait name-collision OOMs (#765, #951) by @DeusData in #986
• test(mcp): regression guard for relative repo_path canonicalization (#794) by @DeusData in #987
• chore(lsp): add Perl reference to originality-check manifest by @DeusData in #989
• fix(ci): issue labeler no-oped on every issue — (?i) is invalid in JS RegExp by @DeusData in #990
• fix(registry): don't swallow call suffixes on aliased-import direct hits by @DeusData in #1011
• fix(cli): reject unknown tool flags with a nearest-flag suggestion by @DeusData in #1012
• feat(mcp): TOON compact tool output — ~10x fewer response tokens across the query surface by @DeusData in #1013
• fix(mcp): answer resources/prompts discovery with empty lists, not -32601 by @DeusData in #1015
• fix(store): surface SQLITE_CORRUPT from row scans instead of truncating by @DeusData in #1018
• fix(artifact): snapshot exports consistently and refuse corrupt imports by @DeusData in #1019
• fix(store): remove destination WAL/SHM sidecars before installing a fresh DB by @DeusData in #1016
• fix(pipeline): destroy TLS parsers at allocator-epoch boundaries (second-index SIGABRT) by @DeusData in #1027
• fix(win): wide-path canonicalization — drop ANSI _access/_fullpath by @DeusData in #1028
• fix(pipeline): valid JSON for sequential-path service edges and Route nodes by @DeusData in #1030
• feat(cypher): coalesce(var.prop, literal) in WHERE clauses by @DeusData in #1034
• fix(cypher): shortest-path var-length semantics + advertised depth clamp by @DeusData in #1036
• fix(extract): stop CommonJS require() bindings from shadowing call resolution by @DeusData in #1042
• fix(watcher): reindex dirty repos once per distinct state, not per poll by @DeusData in #1045
• test(extract): guard delegation-receiver recursion false positives by @DeusData in #1047
• fix(extract): recover C/C++ defs lost to #ifdef-split brace ERROR regions by @DeusData in #1050
• test(repro): RED reproduction for #964 header QN collision by @DeusData in #1052
• fix(mcp): resolve project arg by unique name tail when exact lookup misses by @DeusData in #1054
• fix(install): give Aider CLI-form instructions instead of MCP tool calls by @DeusData in #1056
• fix(hook): raise + env-configure the augment deadline, breadcrumb on fire by @DeusData in #1055
• fix(install): Windows hook scripts get .cmd form; legacy files removed by @DeusData in #1057
• fix(writer): open the graph DB wide-safe for non-ASCII cache paths by @DeusData in #1058
• fix(routes): mint facade-style Laravel routes and compose group prefixes by @DeusData in #1059
• feat: expand coverage-aware agent integrations by @DeusData in #1069
• feat(objectscript): InterSystems IRIS ObjectScript language support by @isc-tdyar in #467
• fix: compose JAX-RS method-level @path with class-level prefix by @CharlesQueiroz in #1007
• fix(mcp): ignore ::missed shadow rows when resolving a db's project name by @metehanulusoy in #1046
• fix(incremental): name File nodes by basename, matching the full pipeline by @spde in #995
• fix: resolve C/C++ includes to header file targets by matching stems by @Sinjan-Debnath in #983
• fix(cpp): remap recovered definitions to original lines by @blankanswer in #949
• fix(pipeline): restore parallel CALLS resolution for LSP-unresolvable targets by @DeusData in #1106
• fix(tests): isolate integration caches from user state by @tmonestudio in #1067
• fix(extract): populate body_tokens before MinHash gate; add OS/TS identifier node types by @isc-tdyar in #1060
• fix(graph-ui): clear ADR content on delete by @ShiroKSH in #985
• fix(mcp): return structured compact results by @WarGloom in #1043
• fix(ts-runtime): bound GLR stack-merge recursion to prevent stack overflow by @halindrome in #1002
• Fix SQLite writer atomic cache publish by @WarGloom in #940
• fix(extract): snap docstring truncation to UTF-8 codepoint boundary (#1017) by @harshitaajoshi in #1094
• fix(cypher): support coalesce() and other multi-arg scalar functions in WHERE (#874) by @harshitaajoshi in #991
• fix(cypher): return whole value for composite and escaped properties by @JhohanBustamante in #1098
• fix(fqn): preserve full filename in File-node QNs so sibling files don't collide by @DeusData in #1108
• fix(pipeline): stop CI/tooling config URLs from minting infra Route nodes by @DeusData in #1048
• fix(cypher): add a wall-clock execution deadline to abort runaway queries (#601) by @DeusData in #1109
• fix(foundation): use HW_PHYSMEM for physical memory detection on FreeBSD by @PR9000 in #1093
• fix(py-lsp): resolve calls through aliased imports by @DeusData in #1049
• fix(extract): don't flag in-body function-like macro calls as parse gaps (#1071) by @DeusData in #1135
• fix(grammars): widen uint8_t loop counters in objectscript scanner (CodeQL #69-#72) by @DeusData in #1136
• fix(store): bound the WAL (journal_size_limit) + warn on checkpoint starvation (#1083 part 1) by @DeusData in #1137
• Tree-format tool output: prefix-grouped rows, exactly-once pagination, real change impact, cycle detection by @DeusData in #1154
• Parallel test execution: per-suite processes with a zero-loss gate contract by @DeusData in #1164
• feat: coordinate concurrent CBM sessions by @DeusData in #1139
• ci,test: keep a spaced SANITIZE value one make argument end to end by @DeusData in #1223
• test: size the daemon-application wait budget for TSan's slowdown tail by @DeusData in #1224
• Deterministic QA gates, dry-run fixes, and graph-quality repairs by @DeusData in #1230
• fix: harden daemon release paths and verification by @DeusData in #1252
• fix(store): drop the SQLite page-cache slab that faults on arm64 by @DeusData in #1274
• Reapply the #581 thread-heap release (TLS detach callback) by @DeusData in #1275
• Local-remote CI parity: unified venues, artifact/glibc/Defender lanes, dry-run red fixes by @DeusData in #1280
• fix(contract): 0h VM-soak needle onto the canonical soak entry (dry-run test-wave red) by @DeusData in #1281
• ci: revert runner-side Defender gating (RTP policy-locked off on hosted images) by @DeusData in #1282
• Local-ladder green: BSD mktemp soak fix (CI-mac-gating) + 0h port-poll tolerance + Alpine curl by @DeusData in #1285
• Cycle-4 dry-run fixes: real Phase-15 UI probe, header-only readiness, 30s diagnostics window by @DeusData in #1288
• Cycle-5: soak .exe resolution (root cause of both Windows runner soak reds) + preflight cleanup race by @DeusData in #1289
• ci(smoke): 30-minute smoke budget (v5 lost 13 green-path jobs to the 15-min wall) by @DeusData in #1291
• ci(release): correct channel semantics for semver prereleases by @DeusData in #1303
• test(watcher): starved-runner budget for the blocked-git spawn-marker wait by @DeusData in #1306
• test(daemon-app): yield in the terminal-job wait like every sibling helper by @DeusData in #1307
• test(daemon-app): wait for the stable terminal state, not the draining window by @DeusData in #1309
• fix(windows): ship one binary — remove the launcher stub flagged as a dropper by @DeusData in #1316
• docs(readme): single-binary layout, Windows update flow, current test count by @DeusData in #1318
• fix(windows): repair install.ps1, honest dry-run status, deterministic daemon_ipc by @DeusData in #1320
• test(smoke): retire the Windows Phase 14 missing-executable requirement by @DeusData in #1321
• fix(windows): absorb transient file locks when retiring a running image by @DeusData in #1322
• fix(release): strip shipped binaries by @DeusData in #1328
• refactor(cli): move self-update to the install scripts; strip Mach-O fully by @DeusData in #1332
• fix(security): declare the printed install-script URL on the allow-list by @DeusData in #1333
• fix: install-script update handoff, Mach-O strip, security alerts, Windows determinism by @DeusData in #1338
• ci(release): double-verify ML antivirus false positives instead of re-rolling builds by @DeusData in #1340
• ci(release): revert the VT gate to zero tolerance by @DeusData in #1341
• harden: remove capability that should never have shipped by @DeusData in #1344
• security: record the mimalloc local patch in the vendored manifest by @DeusData in #1345
• fix(main): guard the seam call sites instead of stubbing the seams by @DeusData in #1346
• fix(release): make the new CI scripts executable, and pin the exec-bit class by @DeusData in #1349
• fix(release): skip_tests silently skipped smoke and soak too by @DeusData in #1350
• chore: remove local soak/memlab run output committed to main by @DeusData in #1352
• fix(cypher): bound UNWIND literal-list buffer to prevent stack overflow by @SEPURI-SAI-KRISHNA in #1173
• fix(store): clamp ADR render cursor to prevent stack overflow by @SEPURI-SAI-KRISHNA in #1175
• fix(cypher): bounds-check and error-propagate cross_join_nodes allocation by @SEPURI-SAI-KRISHNA in #1176
• fix(win): compile cleanly with MinGW GCC by @Oxygen56 in #1226
• fix(parser): use alias-safe Haskell arrays by @WarGloom in #1232
• build(deps): Bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.1 by @dependabot[bot] in #1156
• build(deps): Bump actions/setup-node from 6.4.0 to 7.0.0 by @dependabot[bot] in #1157
• fix(extract): Nix definitions are dropped in any file whose root expression is a function by @sini in #1304
• fix(mcp): resolve index_repository's repo_path from a known project name by @AmirF194 in #1258
• fix(stale): mark awaiting-reporter issues stale, never auto-close by @DeusData in #1269
• fix(mcp): preserve coverage scope labels by @aaiyer in #1148
• fix(extract): keep decorators separated by a comment by @JhohanBustamante in #1097
• fix(extract): derive unique names for GoogleTest macros to prevent same-file node collisions (#1266) by @harshitaajoshi in #1329
• Mention un-skip option in docs by @gandie in #1131
• fix(graph-ui): rank Accept-Language by q instead of substring match by @lukiod in #1313
• feat(ci): acknowledge new pull requests automatically by @DeusData in #1270
• chore(deps): Bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #1023
• docs: remove stale language and test counts by @CooperSheroy in #605
• fix(cli): derive --help tool list from the MCP registry by @DeusData in #1370
• fix: flatten JS/TS template-literal URLs to {} placeholders by @CharlesQueiroz in #1008
• fix(mcp): reject misleading ADR sections writes by @M-Marbouh in #1141
• fix(extract): model Nix attrpaths (leaf name, scoped QN) and mint Variables for module-level bindings by @sini in #1305
• feat(pkgmap): resolve Package.swift manifests for cross-package IMPORTS by @gsdali in #1222
• fix(cypher): bound OPTIONAL fallback in expand_pattern_rels to a single ceiling by @SEPURI-SAI-KRISHNA in #1177
• fix(cypher): classify aggregation columns by is_aggregate_func, not a bare func check by @AmirF194 in #1221
• fix(security): audit shared agent skills by @agn-7 in #1373
• feat(mcp): surface edge resolution provenance behind include_evidence by @DeusData in #1376
• fix(mcp): keep ADR reads nonblocking during reindex by @SS-42 in #892
• fix(store): route label allowlists through the canonical type-like set by @DeusData in #1380
• fix(mcp): scope detect_changes seed detection to changed line ranges by @lishixiang0705 in #1372
• fix(cypher): never fabricate an OPTIONAL "no match" after the budget fills by @DeusData in #1385
• fix: preserve exact semantic graph relationships by @DeusData in #1166
• feat(install): generate pi and OpenCode extensions from the tool registry by @DeusData in #1392
• fix(similarity): skip empty fingerprint sort by @WarGloom in #1368
• fix(install): declare a transport in generated Codex agent role TOMLs by @dergachoff in #1408
• fix(worker): preserve delivered MCP errors by @WarGloom in #1369
• fix(mcp): set stdio to binary mode on Windows by @ahmadgamal15-art in #1424
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #1395
• test(extract): bind the Java interface/enum method dedup fix (#1234) by @DeusData in #1433
• ci(codeql): bump init and analyze together to v4.37.3 by @DeusData in #1434
• build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2 by @dependabot[bot] in #1396
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #1397
• fix(install): never remove existing hook entries on a refused script rewrite (#1387) by @DeusData in #1435
• fix(daemon): answer the client when its binary image is rejected (#1383) by @DeusData in #1439
• fix(mcp): stop quarantining an anonymous temp db on invalid project names (#1425) by @DeusData in #1437
• fix(cli): attribute activation refusals to the recorded safety check (#1416) by @DeusData in #1449
• fix(cypher): parse and apply the full multi-key ORDER BY list, keeping LIMIT (#1334) by @DeusData in #1436
• ci(codeql): bump init and analyze together to v4.37.4 by @DeusData in #1440
• fix(hook): surface daemon build conflicts to the hook caller (#1388) by @DeusData in #1441
• fix(tests): resolve the prod binary from CBM_TEST_BINARY, not a hardcoded build/c by @DeusData in #1463
• fix(ci): isolate local-CI runs per run id, and tidy what each run creates by @DeusData in #1465
• fix: tighten buffer, recursion and indexing-root bounds by @DeusData in #1464
• diag(daemon): name the cohort path that admits a mismatched build by @DeusData in #1474
• fix(subprocess): spawn instead of fork+exec on macOS by @DeusData in #1475
• test(similarity): cover the empty-graph qsort null base (#1367) by @DeusData in #1476
• fix(mem): route ordinary malloc through mimalloc on Linux (#1360) by @DeusData in #1477
• fix(cli): make --dry-run predict a refused hook-script rewrite (#1387) by @DeusData in #1473
• feat: declare indexing roots from the CLI; size-safe compression; prune the cache from discovery by @DeusData in #1472
• fix(windows): hide the console windows of spawned child processes by @mlandolfi90 in #1448
• fix(windows): suppress the console window on the last spawn site (#1427) by @DeusData in #1485
• fix(daemon): answer an oversized MCP reply with an error, not process death (#1375) by @DeusData in #1486
• ci(dry-run): scan the archive artifacts with VirusTotal as the final step by @DeusData in #1489
• perf(mcp): stop repeating the payload in structuredContent (#1375) by @DeusData in #1488
• ci(dry-run): add skip_smoke for a direct build → VirusTotal pass by @DeusData in #1490
• ci(vt-gate): name the engine that flagged, not just the count by @DeusData in #1491
• harden(cli): stop shipping a policy-bypass invocation inside the binary by @DeusData in #1492
• harden: ship integration templates as a verified JSON asset, not embedded bytes by @DeusData in #1493
• fix(release): externalize runtime assets and harden VT verification by @DeusData in #1501
• fix(ci): isolate release archive downloads by @DeusData in #1503
• Re-embed runtime assets, ship one archive set, and tolerate a single Microsoft !ml verdict by @DeusData in #1508
• fix(ci): finish the single-composition sweep in the smoke workflow by @DeusData in #1515
• fix(diagnostics): report OS-truth RSS, not mimalloc's Linux commit counter by @DeusData in #1516
• test(bench): make the py-lsp time budget a liveness backstop, not a perf gate by @DeusData in #1517

New Contributors

• @alex-plosceac made their first contribution in #916
• @muba00 made their first contribution in #920
• @blankanswer made their first contribution in #948
• @Cosm1cAC made their first contribution in #956
• @aaiyer made their first contribution in #939
• @yangsec888 made their first contribution in #954
• @LA-10 made their first contribution in #979
• @Dhruvy0804 made their first contribution in #982
• @CharlesQueiroz made their first contribution in #1007
• @metehanulusoy made their first contribution in #1046
• @spde made their first contribution in #995
• @Sinjan-Debnath made their first contribution in #983
• @tmonestudio made their first contribution in #1067
• @ShiroKSH made their first contribution in #985
• @WarGloom made their first contribution in #1043
• @harshitaajoshi made their first contribution in #1094
• @JhohanBustamante made their first contribution in #1098
• @PR9000 made their first contribution in #1093
• @SEPURI-SAI-KRISHNA made their first contribution in #1173
• @Oxygen56 made their first contribution in #1226
• @sini made their first contribution in #1304
• @AmirF194 made their first contribution in #1258
• @gandie made their first contribution in #1131
• @lukiod made their first contribution in #1313
• @CooperSheroy made their first contribution in #605
• @M-Marbouh made their first contribution in #1141
• @gsdali made their first contribution in #1222
• @agn-7 made their first contribution in #1373
• @lishixiang0705 made their first contribution in #1372
• @dergachoff made their first contribution in #1408
• @ahmadgamal15-art made their first contribution in #1424
• @mlandolfi90 made their first contribution in #1448

Full Changelog: v0.9.0...v0.10.0

Security Verification

VirusTotal completed 14 distinct extracted byte objects covering 32 exact extracted archive members.
The extraction manifest binds those associations to 8 downloadable archives by SHA-256 provenance. Downloadable .tar.gz/.zip release containers were not submitted to VirusTotal.

Every scanned object returned 0 malicious and 0 suspicious verdicts with 54–69 decisive engine results (required minimum: 50).
Microsoft returned a decisive clean verdict for all 8 executable objects.

Durable public evidence: associations, exact scan set, per-extracted-object results and report links, evidence checksums.

Archive SHA-256 provenance (from the extraction manifest):