Merge upstream main through 69af19ac (native-kernel reconciliation)

.github/workflows/release.yml

@@ -32,7 +32,7 @@ jobs:
   # Native extraction-kernel prebuilds (docs/design/rust-kernel-migration-plan.md).
   # The kernel is the ONLY parser (no wasm fallback since the kernel-only
   # extraction plan's Phase 5), so this matrix is REQUIRED: a failed kernel
-  # build blocks the release, and build-bundle.sh refuses to stage a bundle
+  # build blocks the release, and the bundle recipe refuses to stage a bundle
   # without a prebuild. (Formerly: per-file wasm fallback for erroring files and unsupported
   # platforms — but every published bundle must carry its .node. Note the
   # vendored-grammar-C languages (kotlin/lua/scala/dart) compile parser.c via

BUNDLING.md

@@ -33,6 +33,10 @@ scripts/build-bundle.sh linux-x64            # -> release/codegraph-linux-x64.ta
 scripts/build-bundle.sh win32-x64            # -> release/codegraph-win32-x64.zip
 ```
 
+The Node runtime is the official nodejs.org release named by the script's
+default `NODE_VERSION` (or its second argument). The download is refused
+unless it matches the SHA-256 listed in that release's `SHASUMS256.txt`.
+
 Because dropping better-sqlite3 left **zero native addons**, building a bundle is
 pure file-packaging — **any** target builds on **any** OS (the whole matrix builds
 on one Linux runner). Cross-compilation isn't a concern; only *run-testing* a

README.md

@@ -52,7 +52,7 @@ Follow [@getcodegraph](https://x.com/getcodegraph) on X for updates.
 
 ## About this fork
 
-This is **bompus/codegraph**, a fork of [colbymchenry/codegraph](https://github.com/colbymchenry/codegraph). Its default branch, `fork/consolidated`, contains upstream `main` through [`553d5d10`](https://github.com/colbymchenry/codegraph/commit/553d5d101dd8c8ed65e83480e31192e836d8431a) (after v1.6.2) plus the fork's own work, and it takes upstream changes as they land. Changes that suit upstream are also offered there as pull requests.
+This is **bompus/codegraph**, a fork of [colbymchenry/codegraph](https://github.com/colbymchenry/codegraph). Its default branch, `fork/consolidated`, contains upstream `main` through [`69af19ac`](https://github.com/colbymchenry/codegraph/commit/69af19ace270f2e940444d514de6dde971df12df) (after v1.6.2) plus the fork's own work, and it takes upstream changes as they land. Changes that suit upstream are also offered there as pull requests.
 
 The fork publishes no releases. The install scripts, npm package, badges and `codegraph upgrade` further down this page install **upstream's** releases. To run the fork, build it from source (below).
 

__tests__/bundle-launcher.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it } from 'vitest';
 import { spawnSync } from 'child_process';
+import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -124,3 +125,96 @@ describe('bundled launchers (#1278)', () => {
     }
   });
 });
+
+describe('bundled Node runtime (#2617)', () => {
+  it('ships a Node 24 release with the fix for the Windows abort at exit', () => {
+    // The release workflow passes only the target, so the recipe's default
+    // version is the Node every release bundles.
+    const workflow = fs.readFileSync(path.resolve('.github/workflows/release.yml'), 'utf8');
+    const calls = workflow.match(/build-bundle\.sh[^\r\n]*/g) ?? [];
+    expect(calls.length).toBeGreaterThan(0);
+    for (const call of calls) expect(call.trim()).toBe('build-bundle.sh "$t"');
+
+    const pin = /^NODE_VERSION="\$\{2:-v(\d+)\.(\d+)\.(\d+)\}"\r?$/m.exec(recipe);
+    expect(pin, 'default NODE_VERSION in scripts/build-bundle.sh').not.toBeNull();
+    const [major, minor] = pin!.slice(1, 3).map(Number);
+    // The CLI refuses to run on Node 25 and later.
+    expect(major).toBe(24);
+    // Node 24 before 24.20.0 can abort on Windows as the process exits, after
+    // the command's work is done (0xC0000409, nodejs/node#56645).
+    expect(minor).toBeGreaterThanOrEqual(20);
+  });
+});
+
+describe('bundled Node security release (#2780)', () => {
+  const archive = 'node-v24.22.1-linux-x64.tar.gz';
+
+  // Step 1 of the release recipe, run against a stand-in for nodejs.org: `curl`
+  // copies the requested file out of `site/` and logs the URL it was asked for.
+  function download(sums: (sha: string) => string) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'codegraph-node-download-'));
+    roots.push(root);
+    const site = path.join(root, 'site');
+    const work = path.join(root, 'work');
+    fs.mkdirSync(path.join(site, 'node-v24.22.1-linux-x64', 'bin'), { recursive: true });
+    fs.mkdirSync(work);
+    fs.writeFileSync(path.join(site, 'node-v24.22.1-linux-x64', 'bin', 'node'), '#!/bin/sh\n');
+    const arg = (n: number) => windows ? `$(cygpath -u "$${n}")` : `$${n}`;
+    // Packed the way nodejs.org packs a release: one top-level folder.
+    const pack = shell(`set -eu\ncd "${arg(1)}"\ntar -czf ${archive} node-v24.22.1-linux-x64`, [site]);
+    expect(pack.status, pack.stderr).toBe(0);
+    const sha = crypto.createHash('sha256').update(fs.readFileSync(path.join(site, archive))).digest('hex');
+    fs.writeFileSync(path.join(site, 'SHASUMS256.txt'), sums(sha));
+    const step = recipe.slice(recipe.indexOf('# 1. Download'), recipe.indexOf('# 2. Build'));
+    const result = shell(`set -euo pipefail
+WORK="${arg(1)}"
+SITE="${arg(2)}"
+TARGET=linux-x64 OSFAM=linux ARCH=x64 NODE_VERSION=v24.22.1
+curl() {
+  local url='' out=''
+  while [ $# -gt 0 ]; do
+    case "$1" in -o) out="$2"; shift 2 ;; -*) shift ;; *) url="$1"; shift ;; esac
+  done
+  printf '%s\\n' "$url" >> "$WORK/urls"
+  cp "$SITE/\${url##*/}" "$out"
+}
+${step}
+printf 'NODE_BIN=%s\\n' "$NODE_BIN"`, [work, site]);
+    const urls = fs.existsSync(path.join(work, 'urls'))
+      ? fs.readFileSync(path.join(work, 'urls'), 'utf8').trim().split('\n')
+      : [];
+    return { result, work, urls };
+  }
+
+  it('ships Node 24.22.1, the October 2026 security release, or a later 24.x', () => {
+    const pin = /^NODE_VERSION="\$\{2:-v(\d+)\.(\d+)\.(\d+)\}"\r?$/m.exec(recipe);
+    expect(pin, 'default NODE_VERSION in scripts/build-bundle.sh').not.toBeNull();
+    const [major, minor, patch] = pin!.slice(1, 4).map(Number);
+    expect(major).toBe(24);
+    // 24.22.1 fixes eight CVEs (four rated High) and ships OpenSSL 3.5.9.
+    expect(minor > 22 || (minor === 22 && patch >= 1), `v${major}.${minor}.${patch}`).toBe(true);
+  });
+
+  it('unpacks the Node download once it matches the SHA-256 nodejs.org publishes for it', () => {
+    const other = 'f'.repeat(64);
+    const { result, work, urls } = download((sha) =>
+      `${other}  node-v24.22.1-darwin-arm64.tar.gz\n${sha}  ${archive}\n${other}  node-v24.22.1-win-x64.zip\n`);
+    expect(result.status, result.stderr).toBe(0);
+    expect(urls).toEqual([
+      `https://nodejs.org/dist/v24.22.1/${archive}`,
+      'https://nodejs.org/dist/v24.22.1/SHASUMS256.txt',
+    ]);
+    expect(fs.existsSync(path.join(work, 'node-v24.22.1-linux-x64', 'bin', 'node'))).toBe(true);
+    expect(result.stdout).toMatch(/^NODE_BIN=.*node-v24\.22\.1-linux-x64\/bin\/node\r?$/m);
+  });
+
+  it.each([
+    ['whose SHA-256 differs from the published one', () => `${'0'.repeat(64)}  ${archive}\n`],
+    ['that the published list leaves out', (sha: string) => `${sha}  node-v24.22.1-linux-arm64.tar.gz\n`],
+  ])('refuses a Node download %s, before unpacking it', (_, sums) => {
+    const { result, work } = download(sums);
+    expect(result.status).toBe(1);
+    expect(result.stderr).toContain(`${archive} does not match the SHA-256 that nodejs.org lists for v24.22.1`);
+    expect(fs.existsSync(path.join(work, 'node-v24.22.1-linux-x64'))).toBe(false);
+  });
+});

__tests__/c-macro-return-types.test.ts

@@ -0,0 +1,174 @@
+/**
+ * A C function whose return type is written as a macro call: cJSON's
+ * `CJSON_PUBLIC(char *) cJSON_Print(const cJSON *item)`, libgit2's
+ * `GIT_EXTERN(int) git_blob_dup(…);`. The pre-parse blank for line-leading
+ * markup macros (Unreal's `UPROPERTY(…)`, redis's `REDIS_NO_SANITIZE("bounds")`)
+ * took the macro for markup and blanked it with the return type it wraps. What
+ * was left, `cJSON_Print(…)` and a block, parses as a call: the function had
+ * no node, its callers resolved to nothing, and a header's prototype read as
+ * a call from the header (#2470).
+ *
+ * Markup above a declaration is still blanked: one with a type of its own,
+ * and jemalloc's attribute between a type on the line above and the name.
+ */
+import { describe, it, expect, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import CodeGraph from '../src/index';
+import type { Node } from '../src/types';
+import { blankCppAnnotationMacroCalls } from '../src/extraction/languages/c-cpp';
+
+const lines = (...l: string[]): string => [...l, ''].join('\n');
+
+/** The 1-based line of `text` that contains `needle`, or is exactly it with `exact` (exactly one must). */
+const lineOf = (text: string, needle: string, exact = false): number => {
+  const at = text.split('\n').map((l, i) => ((exact ? l === needle : l.includes(needle)) ? i + 1 : 0)).filter(Boolean);
+  if (at.length !== 1) throw new Error(`${JSON.stringify(needle)} is on ${at.length} lines`);
+  return at[0]!;
+};
+
+// The issue's reproduction, then shapes around it.
+const LIB_C = lines(
+  '#define EXPORT(type) type',
+  '#define ATTR_FORMAT(a, b)',
+  '#define ATTR(x)',
+  '#define REDIS_NO_SANITIZE(s)',
+  '',
+  'EXPORT(char *) make_name(int id)',
+  '{',
+  '    return id > 0 ? "named" : "anonymous";',
+  '}',
+  '',
+  'EXPORT(int) version(void)',
+  '{',
+  '    return 3;',
+  '}',
+  '',
+  '/* GNU style: the name on its own line. */',
+  'EXPORT(const char *)',
+  'label_for(int id)',
+  '{',
+  '    return id ? "x" : "y";',
+  '}',
+  '',
+  'EXPORT(int) checked_sum(int a, int b) __attribute__((warn_unused_result));',
+  'EXPORT(int) checked_sum(int a, int b)',
+  '{',
+  '    return a + b;',
+  '}',
+  '',
+  'ATTR_FORMAT(1, 2)',
+  'void log_line(const char *fmt, ...)',
+  '{',
+  '}',
+  '',
+  'REDIS_NO_SANITIZE("bounds")',
+  'int key_slot(const char *key)',
+  '{',
+  '    return key[0];',
+  '}',
+  '',
+  'unsigned long',
+  'ATTR(pure)',
+  'usable_size(const void *ptr)',
+  '{',
+  '    return ptr != 0;',
+  '}',
+  '',
+  'int caller(void)',
+  '{',
+  '    log_line("%d", version());',
+  '    return make_name(1) != 0 && usable_size(0) && label_for(2) && checked_sum(1, 2) && key_slot("k");',
+  '}',
+);
+
+// libgit2's header shape: prototypes after a lone macro line and after a doc comment.
+const API_H = lines(
+  '#ifndef API_H',
+  '#define API_H',
+  '#define GIT_EXTERN(type) extern type',
+  '#define GIT_BEGIN_DECL',
+  'GIT_BEGIN_DECL',
+  '',
+  'GIT_EXTERN(int) git_blob_dup(int **out, int *source);',
+  '',
+  '/** Looks the name up. */',
+  'GIT_EXTERN(const char *) git_name(int id);',
+  '#endif',
+);
+
+const API_C = lines(
+  '#include "api.h"',
+  'int git_blob_dup(int **out, int *source) { *out = source; return 0; }',
+  'const char *git_name(int id) { return id ? "a" : "b"; }',
+  'int use_api(void) { int *p = 0; return git_blob_dup(&p, 0) + (git_name(1) != 0); }',
+);
+
+describe('a C function whose return type is a macro call', () => {
+  const roots: string[] = [];
+  const graphs: CodeGraph[] = [];
+
+  afterEach(() => {
+    for (const cg of graphs.splice(0)) cg.close();
+    for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+  });
+
+  const index = async (files: Record<string, string>): Promise<CodeGraph> => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'codegraph-c-macro-return-'));
+    roots.push(root);
+    for (const [rel, text] of Object.entries(files)) fs.writeFileSync(path.join(root, rel), text);
+    const cg = await CodeGraph.init(root, { index: true });
+    graphs.push(cg);
+    return cg;
+  };
+
+  it('is indexed as a function on its line, and its callers reach it', async () => {
+    const cg = await index({ 'lib.c': LIB_C });
+    const functions = cg.getNodesInFile('lib.c').filter((n: Node) => n.kind === 'function')
+      .map((n) => `${n.name}@${n.startLine}`).sort();
+    expect(functions).toEqual([
+      `caller@${lineOf(LIB_C, 'int caller(void)')}`,
+      `checked_sum@${lineOf(LIB_C, 'EXPORT(int) checked_sum(int a, int b)', true)}`,
+      `key_slot@${lineOf(LIB_C, 'int key_slot(')}`,
+      `label_for@${lineOf(LIB_C, 'EXPORT(const char *)')}`,
+      `log_line@${lineOf(LIB_C, 'void log_line(')}`,
+      `make_name@${lineOf(LIB_C, 'make_name(int id)')}`,
+      `usable_size@${lineOf(LIB_C, 'unsigned long')}`,
+      `version@${lineOf(LIB_C, 'EXPORT(int) version(void)')}`,
+    ].sort());
+    const caller = cg.getNodesInFile('lib.c').find((n: Node) => n.name === 'caller')!;
+    const callees = cg.getCallees(caller.id).filter((r) => r.edge.kind === 'calls').map((r) => r.node.name).sort();
+    expect(callees).toEqual(['checked_sum', 'key_slot', 'label_for', 'log_line', 'make_name', 'usable_size', 'version']);
+  }, 120_000);
+
+  it('a header prototype declares it, and is no call from the header', async () => {
+    const cg = await index({ 'api.h': API_H, 'api.c': API_C });
+    const header = cg.getNodesInFile('api.h').find((n: Node) => n.kind === 'file')!;
+    expect(cg.getOutgoingEdgesFrom([header.id]).filter((e) => e.kind === 'calls')).toEqual([]);
+    const useApi = cg.getNodesInFile('api.c').find((n: Node) => n.name === 'use_api')!;
+    expect(cg.getCallees(useApi.id).filter((r) => r.edge.kind === 'calls').map((r) => `${r.node.name}@${r.node.filePath}`).sort())
+      .toEqual(['git_blob_dup@api.c', 'git_name@api.c']);
+  }, 120_000);
+
+  it('the pre-parse blank leaves it alone, and still blanks markup', () => {
+    const keep = (text: string): string => blankCppAnnotationMacroCalls(text, { keepCReturnTypes: true });
+    const blank = (text: string): string => text.replace(/[^\n\r]/g, ' ');
+    const kept = [
+      'CJSON_PUBLIC(char *) cJSON_Print(const cJSON *item)\n{\n}\n',
+      'GIT_EXTERN(int) git_blob_dup(git_blob **out, git_blob *source);\n',
+      'GIT_INLINE(void) git_free(void *p)\n{\n}\n',
+    ];
+    for (const text of kept) expect(keep(text)).toBe(text);
+    // Markup: not a type, a declaration with its own type, the type on the line above, a statement in a body.
+    expect(keep('ATTR_FORMAT(1, 2)\nvoid log_line(const char *fmt, ...);\n'))
+      .toBe(`${blank('ATTR_FORMAT(1, 2)')}\nvoid log_line(const char *fmt, ...);\n`);
+    expect(keep('ATTR(cold) void die(void);\n')).toBe(`${blank('ATTR(cold)')} void die(void);\n`);
+    expect(keep('size_t JEMALLOC_NOTHROW\nJEMALLOC_ATTR(pure)\nje_sallocx(const void *ptr, int flags) {\n}\n'))
+      .toBe(`size_t JEMALLOC_NOTHROW\n${blank('JEMALLOC_ATTR(pure)')}\nje_sallocx(const void *ptr, int flags) {\n}\n`);
+    expect(keep('void f(void) {\n    FOREACH(node) visit(node);\n}\n'))
+      .toBe(`void f(void) {\n    ${blank('FOREACH(node)')} visit(node);\n}\n`);
+    // C++ gets no exemption.
+    expect(blankCppAnnotationMacroCalls('GIT_EXTERN(int) git_blob_dup(void);\n')).toBe(`${blank('GIT_EXTERN(int)')} git_blob_dup(void);\n`);
+  });
+});