| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
perf(mem): recommit purged memory on macOS so phys_footprint drops 81264814 built the production allocator as mimalloc's release build (-DMI_DEBUG=0). That bought a large speed-up, but it raised what macOS charges an index worker, its phys_footprint: | peak phys_footprint | v0.11.0 | main | |---|---:|---:| | TypeScript | 1.25 GB | 1.94 GB | | dotnet/runtime | 4.5 GB | 12.7 GB | The 2026-10-09 bench missed most of this, because it sampled RSS. The difference is one compile-time branch in mimalloc's unix decommit. With MI_DEBUG or MI_SECURE>2, a purged range is mprotect(PROT_NONE)'d and flagged needs_recommit. A release build leaves it "committed". When the arena hands such a range out again, it is re-accounted as a whole with MADV_FREE_REUSE (arena.c, _mi_os_reuse). macOS then charges every page of it to the footprint, touched or not. On macOS, take the recommit path in every build. Linux and Windows keep upstream's behaviour; there MADV_DONTNEED already drops RSS at once. Measured on Apple arm64 (macOS 26.6), main ec4fbd3a vs this change, cold full indexes interleaved with main (C#: 2 runs each, in the same session as main): | corpus | footprint before | footprint after | change | wall time | |---|---:|---:|---:|---| | TypeScript | 1.98 GB | 1.09 GB | -45 % | unchanged | | kubernetes | 2.92 GB | 1.88 GB | -35 % | unchanged | | dotnet/runtime | 12.6 GB | 4.9 GB | -61 % | unchanged | | linux kernel | 16.0 GB | 13.5 GB | -16 % | 574 -> 559 s | The graph is byte-identical: TypeScript, kubernetes and django give the same nodes, edges and CALLS-set hash. dotnet/runtime is now close to v0.11.0's 4.5 GB. Measured but not taken: - the whole debug build, which costs ~5 % wall time on C#; - MI_STAT=2, MI_PADDING=1 or MI_ENCODE_FREELIST=1 alone, none of which moves the footprint; - MIMALLOC_PURGE_DELAY=0, which is already set. Vendored file changed in place (precedent 1f674c80); its hash in scripts/vendored-checksums.txt is updated and security-vendored.sh passes. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 2 天前 | |
harden: remove capability that should never have shipped Microsoft's ML flagged the rc.1 release binaries. The decisive evidence is that the SAME sha256 went from 0/62 clean to Microsoft-detected in about an hour with no byte change, so the verdict lives partly in scanner-side state and no code change can promise a clean result. What code CAN do is stop shipping things that have no business in a release artifact, which is worth doing on its own merits and incidentally widens the classifier margin. Every claim below is verified against a built binary by the new gate, not by reading source. Executable stack (the worst of the findings). vendored/nomic/code_vectors_blob.S is the only assembly in the build and carried no .note.GNU-stack. An unannotated object makes ld assume the worst for the whole link, so EVERY Linux release we have ever shipped had GNU_STACK RWE. Adds the note (cause) plus ELF-only -Wl,-z,noexecstack (outcome); the gate fails the release if it returns. Test seams are now opt-in, never opt-out. TEST_SEAMS=1 defines CBM_ENABLE_TEST_SEAMS; without it the crash-orphan probe -- which forks a child that ignores SIGTERM and loops forever, then writes its pid to a caller-supplied path -- and the lease-ownership marker compile to trivial stubs, so call sites are untouched and the binary holds no fork, no signal handler and no env-var string. Opt-IN is the point: forgetting the flag yields a clean binary rather than a leaky one. scripts/test.sh requests it in the leg that consumes it, and tests/test_worker_watchdog.sh now asserts the capability up front instead of dying later with an opaque "Killed: 9". The daemon's background version check is gone. It spawned curl against api.github.com/repos/.../releases/latest on the first eligible session of every run to say "a newer version exists" -- a release URL and an outbound request in every shipped binary, for something the install scripts already report. The INJECTABLE SEAM survives: update_ops is still honoured, the fakes in tests/test_daemon_application.c still cover notice/ownership/cancellation/replay, and with no provider application_update_subscribe_locked returns early so no generation ever starts. "No network request by default" is now structural. Dead capability out of release builds. The tar.gz/zip extraction block (gzip_decompress through cbm_extract_binary_from_zip, plus its cli.h declarations) moves under CBM_CLI_ENABLE_TEST_API -- verified self-contained, zero uses of any helper outside it, only callers the excluded updater and tests/test_cli.c. Downloading an archive, decompressing it, picking an executable out of it and marking it executable is the canonical dropper composite; it is now absent rather than merely unreachable. SQLite is built with -DSQLITE_OMIT_LOAD_EXTENSION (no caller of load_extension anywhere in src/ or internal/), removing that API surface and part of the dlopen/dlsym surface. Temp files and environment scanning (S2/S3). Predictable paths in mcp.c, artifact.c and diagnostics.c are created privately and exclusively and written through the returned descriptor; pass_envscan.c no longer descends symlinked directories out of the project root, and its fixed 512-byte path buffers no longer truncate into pointer arithmetic that could land outside the buffer. Build-time entropy. mimalloc's version banner baked __DATE__/__TIME__ into every binary, so two builds of identical source seconds apart could never share a hash and no release could inherit a false-positive determination made about its predecessor. Local patch removes it (marked to survive refreshes), -Wdate-time makes any future use a build error, and -Wl,--no-insert-timestamp stops the PE header carrying the link clock. scripts/ci/check-binary-composition.sh is the proof that each removal stays removed, wired into package-release.sh after strip so the local artifact-flow smoke enforces exactly what CI does. It asserts absences plus a CANARY string, so handing it a compressed, stubbed or empty file fails instead of passing vacuously, and a missing tool is a hard error -- a skipped assertion must never look like a satisfied one. Two build-system traps found by that gate, both of which had silently defeated a fix: the product binary is compiled in one shot from sources, so a flag flip did not rebuild it (now tracked by a .build-config stamp that also removes the binary, making it independent of mtime granularity); and prod_sqlite3.o / prod_mimalloc.o depended on a single named source, so SQLITE_OMIT_LOAD_EXTENSION and the mimalloc patch BOTH compiled to nothing on the first incremental build. Source review would have called them done. Deliberately NOT changed. Three seams stay in release artifacts because scripts/smoke-test.sh runs against the real artifact and needs them: CBM_TEST_CRASH_ON and CBM_TEST_HANG_ON inject the faults that prove supervisor recovery, and CBM_TEST_WINDOWS_USER_PATH_RUN_ID is what keeps the PATH smoke from writing the tester's actual PATH. The gate treats those as an allowlist, so a NOVEL seam still fails. The true no-UI standard build is deferred rather than rushed: src/ui/* is in PROD_SRCS and four files outside src/ui reference UI symbols, including the daemon that serves the UI, so that assertion reports instead of failing until the split lands -- a gate everyone knows is red teaches people to ignore gates. No grammar is removed. ObjectScript accounts for essentially all binary growth since the last provably-clean release (+21.4MB rodata, +1.1MB text from two four-line shims), which made it the obvious ablation candidate, but a dry run performed twelve real Defender endpoint scans across standard/UI and amd64/arm64 with ObjectScript, the daemon and the expanded hooks all present and every scan was clean. Nothing there is a deterministic trigger, so cutting a community-contributed language would spend a real feature on unproven margin. Lean is not a candidate either: at 99.6MB of source it is by far the largest grammar, but it shipped in v0.9.0 which scanned 20/20 clean, so removing it would produce a novel unscanned profile instead of restoring a known-good one. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 2 个月前 | |
docs(vendored): record the SQLite MAX_PATHNAME patch The Unix-VFS MAX_PATHNAME bump from 512 to 4096 shipped with the daemon work but left no paper trail, so the next amalgamation refresh would silently revert it. Document it in vendored/sqlite3/PATCHES.md with the rationale and re-apply procedure, and point to it from THIRD_PARTY.md. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com> | 2 个月前 | |
Fix 3 CI failures: Windows .exe path, tre ssize_t, UI archive name 1. Windows install/update: append .exe to binary path on _WIN32 (was writing empty command to .claude.json) 2. Vendored tre: add ssize_t typedef for Windows (basetsd.h SSIZE_T) 3. Smoke server: copy UI archive under standard name too, so install.sh and update --standard work in UI variant smoke tests | 6 个月前 | |
Complete vendored license coverage; rework THIRD_PARTY.md Restore upstream LICENSE files for every vendored grammar and C library across both vendored trees (19 grammar dirs, lz4, zstd, simplecpp, verstable, wyhash, ts_runtime, common, mongoose, xxhash, yyjson; SQLite public-domain notice). Add the nomic-embed-code Apache-2.0 license plus a NOTICE describing the embedding derivation. First-party grammars carry the project MIT license. THIRD_PARTY.md now defers grammar provenance to the verified MANIFEST.md instead of a stale hand-written table (which misattributed clojure as EPL-1.0 — it is CC0-1.0), covers all vendored libraries, and documents the Hybrid LSP reference servers and stdlib type-data provenance (typeshed, Go stdlib introspection, hand-curated specs). | 3 个月前 | |
Complete vendored license coverage; rework THIRD_PARTY.md Restore upstream LICENSE files for every vendored grammar and C library across both vendored trees (19 grammar dirs, lz4, zstd, simplecpp, verstable, wyhash, ts_runtime, common, mongoose, xxhash, yyjson; SQLite public-domain notice). Add the nomic-embed-code Apache-2.0 license plus a NOTICE describing the embedding derivation. First-party grammars carry the project MIT license. THIRD_PARTY.md now defers grammar provenance to the verified MANIFEST.md instead of a stale hand-written table (which misattributed clojure as EPL-1.0 — it is CC0-1.0), covers all vendored libraries, and documents the Hybrid LSP reference servers and stdlib type-data provenance (typeshed, Go stdlib introspection, hand-curated specs). | 3 个月前 |