Merge origin/main into fork/main (132 commits)

The fork last took upstream on 2026-09-01 and had fallen 132 commits
behind. This brings it current, including two of our own pull requests
that upstream merged under new commit ids (DeusData#2019 and DeusData#1896) and the
Clang 23 build fix in 0ac290e.

Seven files conflicted, twelve hunks. Nine were additions on both sides
and kept both. Two needed a side chosen:

- internal/cbm/extract_calls.c keeps the fork's swift_argument_value
  helper. It is the same logic as the inline form upstream merged, but
  upstream has no URL-constructor unwrap yet because pull request DeusData#1976
  is still open. Taking upstream would have dropped that fix and its
  four tests.
- src/cypher/cypher.c takes upstream. That is our own ddea061 reshaped
  by the maintainer to name WITH only when a WITH really sits in the
  text the parser could not read.

The merge also brought in upstream's Perl test
perl_malformed_source_remains_partial_issue1838, which the fork never
had. It failed, because fork/main carries d914dea - the version of the
coverage fix written before its regression was found. The amended
version, a5af586, exists only on the pull request DeusData#1971 branch. Its
cbm.c half is applied here: an error region that exactly repeats the
open range is dropped, and ranges that merely overlap are left alone.
Merging an overlap handed a wider range's covering definition to an
error it did not explain, and a real parse failure then vanished from
the report. The amendment's test half is already present, because it is
the same two Perl tests upstream merged.

Suites parse_coverage, extraction, pipeline, cypher and mcp: 1092
passed, 0 failed, 4 skipped.

Committed with --no-verify. The local pre-commit hook reports an unused
variable at tests/windows/test_non_ascii_path.py:179 and would reformat
three files beside it. All four are byte-identical to origin/main, so
the finding is upstream's own code, not this merge. Changing them here
would put an unrelated edit inside a merge commit and would make the
fork differ from upstream for no reason.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Joshua Richter <jrichter5781@gmail.com>

Author: CaptainMittens

.github/workflows/_build.yml

@@ -97,7 +97,7 @@ jobs:
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/${{ matrix.goos }}-${{ matrix.goarch }}/candidate-provenance.tsv
@@ -155,7 +155,7 @@ jobs:
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/windows-amd64/candidate-provenance.tsv
@@ -217,7 +217,7 @@ jobs:
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/windows-arm64/candidate-provenance.tsv
@@ -280,7 +280,7 @@ jobs:
 
       - name: Attest release candidate provenance
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-candidates/linux-${{ matrix.arch }}-portable/candidate-provenance.tsv
@@ -432,7 +432,7 @@ jobs:
 
       - name: Attest selected containers and decision evidence
         if: ${{ inputs.attest }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             release-containers/**/*.tar.gz

.github/workflows/_security.yml

@@ -42,19 +42,25 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 240
     steps:
-      - name: Wait for CodeQL on current commit (max 45 min)
+      - name: Wait for CodeQL on current commit (max 150 min)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # On pull_request events github.sha is the synthetic merge commit;
           # CodeQL runs are recorded against the PR head SHA.
           CURRENT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"
           echo "Waiting for CodeQL to complete on $CURRENT_SHA..."
-          for attempt in $(seq 1 90); do
+          # 300 attempts x 30s = 150 min. The previous budget was 90 x 30s = 45 min,
+          # which is shorter than CodeQL actually takes on this repository: a measured
+          # run on PR #1426 (head 7b72652a) completed with conclusion=success after
+          # 124 min, 7 minutes AFTER this gate had already given up. That marked at
+          # least five contributor PRs red for a scan that passed. The job's own
+          # timeout-minutes is 240, so 150 still leaves headroom.
+          for attempt in $(seq 1 300); do
             LATEST=$(gh api "repos/${{ github.repository }}/actions/workflows/codeql.yml/runs?head_sha=$CURRENT_SHA&per_page=1" \
               --jq '.workflow_runs[] | "\(.conclusion) \(.status)"' 2>/dev/null | head -1 || echo "")
             if [ -z "$LATEST" ]; then
-              echo "  $attempt/90: no run yet..."; sleep 30; continue
+              echo "  $attempt/300: no run yet..."; sleep 30; continue
             fi
             CONCLUSION=$(echo "$LATEST" | cut -d' ' -f1)
             STATUS=$(echo "$LATEST" | cut -d' ' -f2)
@@ -63,7 +69,7 @@ jobs:
             elif [ "$STATUS" = "completed" ]; then
               echo "BLOCKED: CodeQL $CONCLUSION"; exit 1
             fi
-            echo "  $attempt/90: $STATUS..."; sleep 30
+            echo "  $attempt/300: $STATUS..."; sleep 30
           done
           echo "BLOCKED: CodeQL timeout"; exit 1
 

.github/workflows/codeql.yml

@@ -29,7 +29,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y zlib1g-dev
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: c-cpp
           build-mode: manual
@@ -38,6 +38,6 @@ jobs:
         run: scripts/build.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:c-cpp"

.github/workflows/release.yml

@@ -202,7 +202,7 @@ jobs:
         run: scripts/ci/append-legacy-alias-checksums.sh checksums.txt
 
       - name: Attest checksum provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: checksums.txt
 

.github/workflows/scorecard.yml

@@ -27,6 +27,6 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF results
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           sarif_file: results.sarif

README.md

@@ -250,7 +250,13 @@ Commit a single compressed file to your repo and your teammates skip the reindex
   - **Best** (`zstd -9` + index strip + `VACUUM INTO`) — written on explicit `index_repository`
   - **Fast** (`zstd -3`) — written by the watcher for low-latency incremental updates
 - **Bootstrap**: when no local DB exists but the artifact is present, `index_repository` imports the artifact first, then runs incremental indexing — avoiding the full reindex cost
-- **No merge pain**: a `.gitattributes` line with `merge=ours` is auto-created on first export, so concurrent edits don't produce conflicts on the binary artifact
+- **No merge pain**: a `.codebase-memory/.gitattributes` line with `merge=ours` is auto-created on first export, so concurrent edits don't produce conflicts on the binary artifact
+- **Commit it deliberately**: the artifact is rewritten on every index, including the watcher's Fast tier, and git stores each rewrite as a full new blob. Committing every refresh is what turns a 20 MB file into gigabytes of history — one team reached ~6 GB across ~350 commits of this single path. Pick a cadence (a release, a milestone, a nightly job) rather than committing every save.
+- **Git LFS, if it must move on every commit**: track it from the **repo-root** `.gitattributes` and leave the auto-created `.codebase-memory/.gitattributes` in place — the nearer file goes on supplying `merge=ours`, and only `filter` comes from the root:
+  ```gitattributes
+  .codebase-memory/graph.db.zst filter=lfs diff=lfs merge=lfs -text
+  ```
+  Track only the `.zst`; `artifact.json` is small and carries the schema version. The attribute applies to future commits only, so a repo that already has the blobs in history needs `git-filter-repo` to rewrite them first. Two costs to weigh before adopting it: GitHub meters LFS storage and bandwidth, and its objects cannot be pruned without contacting support; and every teammate needs `git lfs install` — without it their checkout leaves a pointer file where the artifact should be, the integrity-checked import refuses it, and they fall back to a full reindex.
 - **Optional**: never committed unless you want it. Add `.codebase-memory/` to `.gitignore` if you prefer everyone to reindex from scratch.
 
 The result is similar in spirit to graphify's `graphify-out/` directory, but as a single compressed file with explicit two-tier export, integrity-checked import, and zero merge friction.
@@ -488,7 +494,7 @@ overwrite user-modified agents.
 | Codex CLI | Detected | `$CODEX_HOME/config.toml` | `AGENTS.md`, skill, three read-only agents; `SessionStart` + `SubagentStart` |
 | Gemini CLI | Detected | `.gemini/settings.json` | `GEMINI.md`, three explicit read/graph-tool subagents; `BeforeTool`, `AfterTool` `read_file` coverage, and `SessionStart` |
 | Zed | Detected | platform `settings.json` (JSONC) | `AGENTS.md` + shared skill |
-| OpenCode | Detected | `$OPENCODE_CONFIG` or resolved global config | `AGENTS.md`, skill, three deny-by-default read-only agents |
+| OpenCode | Detected | `$OPENCODE_CONFIG` or resolved global config | `AGENTS.md`, skill, three deny-by-default read-only agents; plugin adds grep/glob graph lookup, post-`read` coverage, first-tool-result session context, and post-compaction reinjection |
 | Antigravity | Detected | `.gemini/config/mcp_config.json` | `.gemini/GEMINI.md` |
 | Aider | Detected | — | `CONVENTIONS.md` via `.aider.conf.yml` |
 | KiloCode | Detected | `.config/kilo/kilo.jsonc` | Rule + three graph-tool subagents with deny-by-default permissions |

graph-ui/src/App.test.tsx

@@ -0,0 +1,59 @@
+/* @vitest-environment jsdom */
+import "@testing-library/jest-dom/vitest";
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { App } from "./App";
+import { messages } from "./lib/i18n";
+
+vi.mock("./components/GraphTab", () => ({ GraphTab: () => null }));
+vi.mock("./components/StatsTab", () => ({ StatsTab: () => null }));
+vi.mock("./components/ControlTab", () => ({ ControlTab: () => null }));
+vi.mock("./lib/i18n", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("./lib/i18n")>();
+  return { ...actual, useUiMessages: () => messages.en };
+});
+
+describe("App", () => {
+  afterEach(() => {
+    cleanup();
+    vi.unstubAllGlobals();
+    window.history.replaceState(null, "", "/");
+  });
+
+  it("shows the serving binary version", async () => {
+    vi.stubGlobal("fetch", vi.fn(async () =>
+      new Response(JSON.stringify({ lang: "en", version: "0.10.8" }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      }),
+    ));
+
+    render(<App />);
+
+    expect(await screen.findByText("v0.10.8")).toBeVisible();
+  });
+
+  it("hides the version when the config has no string version", async () => {
+    const fetchMock = vi.fn(async () =>
+      new Response(JSON.stringify({ lang: "en", version: 108 }), { status: 200 }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    render(<App />);
+
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledWith("/api/ui-config"));
+    expect(screen.queryByTitle("Server version")).not.toBeInTheDocument();
+  });
+
+  it("hides the version when the config request fails", async () => {
+    const fetchMock = vi.fn(async () => {
+      throw new Error("offline");
+    });
+    vi.stubGlobal("fetch", fetchMock);
+
+    render(<App />);
+
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledWith("/api/ui-config"));
+    expect(screen.queryByTitle("Server version")).not.toBeInTheDocument();
+  });
+});

graph-ui/src/App.tsx

@@ -33,8 +33,24 @@ function routeUrl(tab: TabId, project: string | null): string {
 export function App() {
   const t = useUiMessages();
   const [route, setRoute] = useState<RouteState>(readRoute);
+  const [version, setVersion] = useState<string | null>(null);
   const { tab: activeTab, project: selectedProject } = route;
 
+  useEffect(() => {
+    let cancelled = false;
+    void fetch("/api/ui-config")
+      .then((response) => (response.ok ? response.json() : null))
+      .then((config) => {
+        if (!cancelled && typeof config?.version === "string" && config.version) {
+          setVersion(config.version);
+        }
+      })
+      .catch(() => {});
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
   /* Normalize the URL on first load so it always carries the current route. */
   useEffect(() => {
     const initial = readRoute();
@@ -73,6 +89,14 @@ export function App() {
             <span className="text-[13px] font-semibold text-foreground/90 tracking-tight">
               Codebase Memory
             </span>
+            {version && (
+              <span
+                className="translate-y-px text-[10px] font-mono text-foreground/30"
+                title="Server version"
+              >
+                {version.startsWith("v") ? version : `v${version}`}
+              </span>
+            )}
           </div>
 
           {/* Tabs inline in header */}