v0.41.51: bounded text arguments, truthful path and startup answers, review grading by effective visibility #580

Merged

buildagent merged 31 commits from integration-1112 into master 2026-11-12 20:47:07 +01:00

Conversation 0 Commits 31 Files changed 24 +1415 -197

buildagent commented 2026-11-12 18:41:44 +01:00

Member

Copy link

Release train for v0.41.51. Four lanes, each reviewed from its diff and re-run by the lead, integrated on integration-1112.

What changes for a user

• Text arguments are bounded (#575). Every string argument and every entry of a string list is limited to 8,192 characters; longer is refused with invalid_argument_value before any work. This removes the quadratic FTS5 cost of a very long search_text literal. A measured inventory of every text argument up to 1,048,576 characters found no other superlinear path.
• No internal_error from caller text. The name-token fallback of search_symbols considers at most 512 tokens and discloses the rest; long path_glob/lang values and unrepresentable paths get structured answers. A test walks every string argument of the published tool list at the limit (113 arguments, 464 calls, no skips).
• Missing paths (#578). read_code on a missing file in a missing directory answers file_not_readable (was path_outside_root). Containment is decided on the deepest existing ancestor after symlink resolution; .. and absolute components are refused lexically before that.
• Review grading (#573). A deleted member is graded by the least visible of itself and its enclosing types; modules never lower a grade. summary.changed_files under path_glob counts the matched files, so the paging invariant holds with and without a filter.
• Startup remedies (#576). index_coverage and three other replies advise a retry while the index is starting; restart advice remains for a degraded index.
• Documentation (#527). docs/configuration.md (every .code-index.toml key and every environment variable the release binaries read, with a two-way key test); 32 false statements corrected in README.md, CONTRIBUTING.md and docs/.

Behaviour changes to call out

• A string argument longer than 8,192 characters is refused. whole_word_needle_unsupported can no longer be reached through MCP.
• review_diff with path_glob: summary.changed_files is the matched-file count.
• A deleted row's visibility in changed_symbols/review_diff is the effective visibility.
• read_code on a dangling symbolic link answers path_outside_root (the last release answered file_not_readable for a dangling last component).

Lead review

• r25 changed a deleted row's wire visibility to the member's own value; restored to the effective value the release reports for locals and destructors, extended to the new rule (d507b67b, mutation run red).
• r24's first batch semantics (per-entry refusal) became a whole-call refusal with the generic rule; accepted as a schema violation of the argument, with the entry index added.
• The path rewrite was read for traversal: lexical refusal of ../absolute/prefix components precedes the ancestor walk, an existing leaf is fully canonicalized, and the symlink cases have tests with a lexical-only mutation.
• #577 (file-level #[test] graded as untested production) was investigated and is not fixable in the host: packages do not emit attributes. Left open with the analysis.

Qualification

One full gate run on the integrated tree (5d31f4d9, 44 steps, 15:33–18:27): formatting, fast gates, clippy for the host and for x86_64-pc-windows-gnu, rustdoc with warnings denied, the workspace suite and its timing profile, doctests, the MCP suite on the daemon leg and its timing profile, precision_gate (7/7, populations printed), the corpus suites as CI runs them, the eleven package legs, scale and tier-3 corpus, the packages-only and shipped-shape acceptance runs, and the nightly-only cost and benchmark steps.

• 42 steps passed. No record moved: tests/corpus/*.json, tests/bench/ratchet.json and the package parity files are unchanged.
• 2 steps failed, both on tests added in this train, both fixed in their own commits and re-run green:
  • every_wall_clock_bound_runs_alone (fast gates and workspace): the new length-refusal test asserts a wall-clock bound and was missing from the nextest timing profile (8c2c374b). Re-run: the registry test passes, the default profile lists 15 fewer MCP tests, and the test passes under the timing profile on both legs.
  • no_resolved_edge_crosses_an_undeclared_crate_boundary (workspace): the new configuration reference test used a type parameter V, and V::Value was bound to a function-local struct V in crates/mcp-server/src/server.rs. This is a resolver defect the last release already has, filed as #579. The test's type parameter is renamed (5c2c347a); the resolver is unchanged. Re-run: the layering test passes.
• After the gate, the push security review flagged the rewritten safe_resolve: it skipped any component canonicalize reported as missing or unrepresentable, which includes a dangling link and a link chain that musl or macOS realpath refuses to expand while the kernel follows it. It now skips only components that symlink_metadata proves absent (fb6f6026). Not reproducible with this machine's glibc; fixed because the release ships a musl build. Tests: 4 unit and 152 e2e on each leg, clippy for both targets, mutation red on the unit test and on working_tree_symlink_escapes_stay_private.
• Windows behaviour is covered by CI only.

Not in this train

• #577 (needs a per-symbol test marker from the language packages).
• #579: a generic parameter used as a qualifier can bind to a function-local type elsewhere (found by this gate; needs a bind account).
• #570: six no-effect configuration keys and six test timing hooks read by release binaries (documented, not changed).
• The resolver and extraction themes (#531, #535, #536, #538, #540, #543, #545 guest side, #566 residual).

🤖 Generated with Claude Code

https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Release train for v0.41.51. Four lanes, each reviewed from its diff and re-run by the lead, integrated on `integration-1112`. ## What changes for a user - **Text arguments are bounded (#575).** Every string argument and every entry of a string list is limited to 8,192 characters; longer is refused with `invalid_argument_value` before any work. This removes the quadratic FTS5 cost of a very long `search_text` literal. A measured inventory of every text argument up to 1,048,576 characters found no other superlinear path. - **No `internal_error` from caller text.** The name-token fallback of `search_symbols` considers at most 512 tokens and discloses the rest; long `path_glob`/`lang` values and unrepresentable paths get structured answers. A test walks every string argument of the published tool list at the limit (113 arguments, 464 calls, no skips). - **Missing paths (#578).** `read_code` on a missing file in a missing directory answers `file_not_readable` (was `path_outside_root`). Containment is decided on the deepest existing ancestor after symlink resolution; `..` and absolute components are refused lexically before that. - **Review grading (#573).** A deleted member is graded by the least visible of itself and its enclosing types; modules never lower a grade. `summary.changed_files` under `path_glob` counts the matched files, so the paging invariant holds with and without a filter. - **Startup remedies (#576).** `index_coverage` and three other replies advise a retry while the index is starting; restart advice remains for a degraded index. - **Documentation (#527).** `docs/configuration.md` (every `.code-index.toml` key and every environment variable the release binaries read, with a two-way key test); 32 false statements corrected in `README.md`, `CONTRIBUTING.md` and `docs/`. ## Behaviour changes to call out - A string argument longer than 8,192 characters is refused. `whole_word_needle_unsupported` can no longer be reached through MCP. - `review_diff` with `path_glob`: `summary.changed_files` is the matched-file count. - A deleted row's `visibility` in `changed_symbols`/`review_diff` is the effective visibility. - `read_code` on a dangling symbolic link answers `path_outside_root` (the last release answered `file_not_readable` for a dangling last component). ## Lead review - r25 changed a deleted row's wire `visibility` to the member's own value; restored to the effective value the release reports for locals and destructors, extended to the new rule (`d507b67b`, mutation run red). - r24's first batch semantics (per-entry refusal) became a whole-call refusal with the generic rule; accepted as a schema violation of the argument, with the entry index added. - The path rewrite was read for traversal: lexical refusal of `..`/absolute/prefix components precedes the ancestor walk, an existing leaf is fully canonicalized, and the symlink cases have tests with a lexical-only mutation. - #577 (file-level `#[test]` graded as untested production) was investigated and is not fixable in the host: packages do not emit attributes. Left open with the analysis. ## Qualification One full gate run on the integrated tree (`5d31f4d9`, 44 steps, 15:33–18:27): formatting, fast gates, clippy for the host and for `x86_64-pc-windows-gnu`, rustdoc with warnings denied, the workspace suite and its timing profile, doctests, the MCP suite on the daemon leg and its timing profile, `precision_gate` (7/7, populations printed), the corpus suites as CI runs them, the eleven package legs, scale and tier-3 corpus, the packages-only and shipped-shape acceptance runs, and the nightly-only cost and benchmark steps. - 42 steps passed. No record moved: `tests/corpus/*.json`, `tests/bench/ratchet.json` and the package parity files are unchanged. - 2 steps failed, both on tests added in this train, both fixed in their own commits and re-run green: - `every_wall_clock_bound_runs_alone` (fast gates and workspace): the new length-refusal test asserts a wall-clock bound and was missing from the nextest timing profile (`8c2c374b`). Re-run: the registry test passes, the default profile lists 15 fewer MCP tests, and the test passes under the timing profile on both legs. - `no_resolved_edge_crosses_an_undeclared_crate_boundary` (workspace): the new configuration reference test used a type parameter `V`, and `V::Value` was bound to a function-local `struct V` in `crates/mcp-server/src/server.rs`. This is a resolver defect the last release already has, filed as #579. The test's type parameter is renamed (`5c2c347a`); the resolver is unchanged. Re-run: the layering test passes. - After the gate, the push security review flagged the rewritten `safe_resolve`: it skipped any component `canonicalize` reported as missing or unrepresentable, which includes a dangling link and a link chain that musl or macOS `realpath` refuses to expand while the kernel follows it. It now skips only components that `symlink_metadata` proves absent (`fb6f6026`). Not reproducible with this machine's glibc; fixed because the release ships a musl build. Tests: 4 unit and 152 e2e on each leg, clippy for both targets, mutation red on the unit test and on `working_tree_symlink_escapes_stay_private`. - Windows behaviour is covered by CI only. ## Not in this train - #577 (needs a per-symbol test marker from the language packages). - #579: a generic parameter used as a qualifier can bind to a function-local type elsewhere (found by this gate; needs a bind account). - #570: six no-effect configuration keys and six test timing hooks read by release binaries (documented, not changed). - The resolver and extraction themes (#531, #535, #536, #538, #540, #543, #545 guest side, #566 residual). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent added 30 commits 2026-11-12 18:41:44 +01:00

fix(review): count analyzed files in filtered page summaries 107b4b7763

fix(mcp): bound text queries through argument policy (#575) d6063c9ec4

test(mcp): replay text length refusals and pin Unicode boundaries (#575) f312a80bd5

fix(review): preserve the unfiltered paging count contract 1730522526

docs: correct contributor build and language package guidance 1b5b229b63

docs: align product claims with package-only release behavior ef46aa2d71

docs: add complete manifest and runtime environment reference with key gate 675286a763

docs: create and commit the version bump before checking it 7c4badabc9

docs: name the CI directory exceptions to hidden path exclusion 79448fe5b2

Merge codex-r26: documentation matches the tree, configuration reference with a key gate (#527) ... 4b5540e0a5

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Grade deleted members by base-side type visibility c9578cec0c

Count the filtered file population across review pages e6cfd05beb

fix(mcp): bound every declared string and token fallback ee8ab773f7

test(mcp): gate every published string argument at its boundary 51bf52de8d

test(mcp): supply resolvable dependency endpoints to the string gate 5c9f920b6a

test(mcp): provide valid glob and handle siblings in the boundary gate 353c4d8fa7

docs(mcp): describe token matches in terms of retained query tokens a23bfd749c

Merge codex-r25: deletions graded by effective type visibility, one file population in review summaries (#573) ... a3a34ab84c

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

fix(mcp): a deleted row reports the visibility its grade was computed from ... d507b67beb

changed_symbols reported the member's own visibility for a deleted
symbol while review_diff graded it by the least visible enclosing type,
and the release's file-visible value for locals and destructors was
lost. The row now carries the effective value in both cases.

Mutation run: reporting the member's own visibility fails
deleted_members_obey_type_visibility and
deleted_container_visibility_uses_recorded_rows.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

fix(mcp): treat unrepresentable parent paths as missing files 44ce41880a

fix(mcp): follow lifecycle in pending eligibility remedies 83ce9c2e61

test(mcp): grade lifecycle-dependent coverage remedies da08e342b8

Identify oversized list entries and preserve metadata validation policies 0cf8fe2cf7

Resolve missing source paths through their deepest existing ancestor e92913caa0

Merge codex-r27: coverage remedies follow the reported lifecycle (#576) ... 38bb588274

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Use a portable array for missing-path fixtures e763725550

chore: v0.41.51 ... 971da36e90

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

Merge codex-r24: one length rule for every string argument, missing paths answered as missing (#575, #578) ... 5d31f4d9e4

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

test: run the text length refusal bound in the timing profile ... 8c2c374bc0

text_query_length_refusal_is_bounded_before_dispatch asserts a wall-clock
bound, so every_wall_clock_bound_runs_alone requires it in the ci-timing
profile and out of the default ci run.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

test: rename a type parameter that the resolver bound across crates ... 5c2c347ae2

`V::Value` in the configuration reference test resolved to the
function-local `struct V` in crates/mcp-server/src/server.rs (tier1q),
which no_resolved_edge_crosses_an_undeclared_crate_boundary reports as two
phantom edges. The resolver defect is tracked in #579; the test no longer
triggers it.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent added 1 commit 2026-11-12 18:58:40 +01:00

fix(read_code): skip only path components proven absent ... fb6f60261c

safe_resolve walked up to the parent whenever canonicalize reported a
component as missing or unrepresentable. An entry that exists but does not
canonicalize is not missing: a dangling link, or a link chain the C library
refuses to expand (musl and macOS bound realpath by PATH_MAX) while the
kernel would still follow it on open. Such a path was then returned as
contained. A component is now skipped only when symlink_metadata proves
nothing is there; anything else is refused.

A dangling link inside the root therefore answers path_outside_root; the
last release answered file_not_readable for a dangling leaf.

Found by the push security review of this branch. Mutation (skip every
uncanonicalizable entry) fails
safe_resolve_refuses_an_existing_entry_it_cannot_canonicalize and
working_tree_symlink_escapes_stay_private.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014XLNPtTbPwnHBYfKMb3f1W

buildagent merged commit 3c8742bf54 into master 2026-11-12 20:47:07 +01:00

buildagent referenced this pull request from a commit 2026-11-12 20:47:09 +01:00

Merge PR #580: v0.41.51 — bounded text arguments, truthful path and startup answers, review grading by effective visibility

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

code-review

  

correctness

  

dos

  

performance

  

security

  

severity/high

  

severity/low

  

severity/medium

  

tech-debt

  

Kind/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority

Critical

The priority is critical

  

Priority

High

The priority is high

  

Priority

Low

The priority is low

  

Priority

Medium

The priority is medium

  

Reviewed

Confirmed

Issue has been confirmed

  

Reviewed

Duplicate

This issue or pull request already exists

  

Reviewed

Invalid

Invalid issue

  

Reviewed

Won't Fix

This issue won't be fixed

  

Status

Abandoned

Somebody has started to work on this but abandoned work

  

Status

Blocked

Something is blocking this issue or pull request

  

Status

Need More Info

Feedback is required to reproduce issue or to continue work

No labels

code-review

correctness

dos

performance

security

severity/high

severity/low

severity/medium

tech-debt

Kind/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/Security

Kind/Testing

Priority

Critical

Priority

High

Priority

Low

Priority

Medium

Reviewed

Confirmed

Reviewed

Duplicate

Reviewed

Invalid

Reviewed

Won't Fix

Status

Abandoned

Status

Blocked

Status

Need More Info

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

h-dv/code-index!580

No description provided.