Merge branch 'main' into fix/769-file-qn-keeps-extension

Author: LA-10

.github/issue-labeler.yml

@@ -1,17 +1,21 @@
-# Config for github/issue-labeler (.github/workflows/issue-labeler.yml).
-# Non-versioned format: one regex per label, matched against title + body.
+# Config for the Issue area labeler (.github/workflows/issue-labeler.yml).
+# FORMAT (parsed line-wise by the workflow): one rule per line, exactly
+#   "label": 'regex'
+# Patterns are compiled as JavaScript RegExp with the `i` flag applied by
+# the workflow — do NOT use PCRE-only syntax like inline `(?i)` groups
+# (that broke every run, #764). Matched against issue title + body.
 # Additive only — these never remove a maintainer's manual label.
 
-"windows": '(?i)\b(windows|win\s?1[01]|powershell|\.ps1|mapped drive|smb share|unc path)\b'
+"windows": '\b(windows|win\s?1[01]|powershell|\.ps1|mapped drive|smb share|unc path)\b'
 
-"stability/performance": '(?i)(out of memory|\boom\b|memory leak|segfault|sigsegv|sigbus|crash(es|ed|ing)?|core dumped|\bhang(s|ing)?\b|deadlock|freezes?|time(s)?\s?out|timeout|never finishes|cgroup)'
+"stability/performance": '(out of memory|\boom\b|memory leak|segfault|sigsegv|sigbus|crash(es|ed|ing)?|core dumped|\bhang(s|ing)?\b|deadlock|freezes?|time(s)?\s?out|timeout|never finishes|cgroup)'
 
-"parsing/quality": '(?i)(trace_path|query_graph|search_graph|calls? edge|missing (edges|nodes)|false positive|zero edges|0 edges|module node|not indexed|extraction|wrong (node|label))'
+"parsing/quality": '(trace_path|query_graph|search_graph|calls? edge|missing (edges|nodes)|false positive|zero edges|0 edges|module node|not indexed|extraction|wrong (node|label))'
 
-"editor/integration": '(?i)(cursor|vscode|vs code|opencode|codex|claude code|gemini cli|antigravity|mcp client|\.mcp\.json|installer)'
+"editor/integration": '(cursor|vscode|vs code|opencode|codex|claude code|gemini cli|antigravity|mcp client|\.mcp\.json|installer)'
 
-"ux/behavior": '(?i)(web ui|\bui\b|dashboard|3d graph|visuali[sz]ation|watcher|project name|frontend)'
+"ux/behavior": '(web ui|\bui\b|dashboard|3d graph|visuali[sz]ation|watcher|project name|frontend)'
 
-"cypher": '(?i)\bcypher\b'
+"cypher": '\bcypher\b'
 
-"language-request": '(?i)(language support|hybrid lsp|new language support|support for \w+ language)'
+"language-request": '(language support|hybrid lsp|new language support|support for \w+ language)'

.github/workflows/_smoke.yml

@@ -248,9 +248,20 @@ jobs:
         run: |
           & "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate 2>$null
           $result = & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "$PWD\codebase-memory-mcp.exe" -DisableRemediation
+          $code = $LASTEXITCODE
           Write-Host $result
-          if ($LASTEXITCODE -ne 0) { Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1 }
-          Write-Host "=== Windows Defender: clean ==="
+          # MpCmdRun -Scan exit codes: 0 = clean, 2 = threat found. Any OTHER non-zero
+          # means the scan engine could not run at all (e.g. hr=0x800106ba: the Defender
+          # antimalware service is unavailable on the runner) — that is NOT a detection.
+          # Fail soft on an engine failure so a transient runner-side AV outage can't
+          # false-fail a release; only a real detection (exit 2) hard-blocks.
+          if ($code -eq 2) {
+            Write-Host "BLOCKED: Windows Defender flagged binary!"; exit 1
+          } elseif ($code -ne 0) {
+            Write-Host "::warning::Windows Defender scan could not run (exit $code) - skipping AV gate on this runner"
+          } else {
+            Write-Host "=== Windows Defender: clean ==="
+          }
 
   smoke-linux-portable:
     needs: setup-matrix

.github/workflows/_test.yml

@@ -88,6 +88,18 @@ jobs:
         env:
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
 
+  test-tsan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install deps (Ubuntu)
+        run: sudo apt-get update && sudo apt-get install -y clang zlib1g-dev
+
+      - name: ThreadSanitizer tests
+        run: make -f Makefile.cbm test-tsan CC=clang CXX=clang++
+
   test-windows:
     needs: setup-matrix
     strategy:

.github/workflows/issue-labeler.yml

@@ -1,9 +1,15 @@
 name: Issue area labeler
 
 # Adds area labels to new/edited issues based on keyword regexes in
-# .github/issue-labeler.yml. Additive only (sync-labels off): it never
-# removes a label a maintainer set by hand. Base bug/enhancement labels
-# already come from the issue forms.
+# .github/issue-labeler.yml. Additive only (addLabels never removes): it
+# never touches a label a maintainer set by hand. Base bug/enhancement
+# labels already come from the issue forms.
+#
+# Implemented with first-party actions/github-script (not a third-party
+# labeler action) so every pattern is compiled as a JavaScript RegExp with
+# the `i` flag applied centrally — inline `(?i)` groups are PCRE-only and
+# threw `SyntaxError: Invalid group` on every issue (#764). A pattern that
+# fails to compile now fails the run loudly instead of silently no-oping.
 
 on:
   issues:
@@ -16,13 +22,38 @@ jobs:
   triage:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       issues: write
     steps:
-      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          configuration-path: .github/issue-labeler.yml
-          enable-versioned-regex: 0
-          include-title: 1
-          include-body: 1
-          sync-labels: 0
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const text = [context.payload.issue.title, context.payload.issue.body]
+              .filter(Boolean).join('\n');
+            const rules = [];
+            const bad = [];
+            // Config format: one rule per line — "label": 'regex' (see the
+            // header comment in .github/issue-labeler.yml).
+            for (const line of fs.readFileSync('.github/issue-labeler.yml', 'utf8').split('\n')) {
+              const m = line.match(/^"([^"]+)":\s*'(.*)'\s*$/);
+              if (!m) continue;
+              try { rules.push({ label: m[1], re: new RegExp(m[2], 'i') }); }
+              catch (e) { bad.push(`${m[1]}: ${e.message}`); }
+            }
+            if (rules.length === 0 && bad.length === 0) {
+              core.setFailed('no labeling rules parsed from .github/issue-labeler.yml');
+              return;
+            }
+            const labels = rules.filter(r => r.re.test(text)).map(r => r.label);
+            if (labels.length) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                labels,
+              });
+            }
+            core.info(`matched: ${labels.join(', ') || '(none)'}`);
+            if (bad.length) core.setFailed(`invalid label regex(es): ${bad.join('; ')}`);

.github/workflows/pr.yml

@@ -51,7 +51,9 @@ jobs:
           PR: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
         run: |
-          FILES=$(gh pr diff "$PR" --repo "$REPO" --name-only)
+          # The full .diff endpoint rejects large-but-valid PRs at 20k lines.
+          # The paginated files endpoint remains filename-only for this gate.
+          FILES=$(gh api --paginate "repos/$REPO/pulls/$PR/files?per_page=100" --jq '.[].filename')
           printf '%s\n' "$FILES"
           if printf '%s\n' "$FILES" | grep -qE '^(src/|internal/|scripts/build\.sh|scripts/smoke-test\.sh|scripts/env\.sh|Makefile\.cbm)'; then
             echo "product=true" >> "$GITHUB_OUTPUT"