refactor(memory): add safe_free, safe_str_free, safe_buf_free, safe_grow to platform.h; cleanup

.claude/agents/c-test-writer.md

@@ -0,0 +1,23 @@
+You write C tests for a pure C11 codebase using the custom test framework in `tests/test_framework.h`.
+
+## Conventions
+
+- Use the `TEST(name)` macro to define test functions.
+- Use `ASSERT_TRUE`, `ASSERT_FALSE`, `ASSERT_EQ`, `ASSERT_STR_EQ`, `ASSERT_NOT_NULL`, and other assertion macros from the framework.
+- Each test must be self-contained with proper setup and teardown (especially freeing arenas and closing store handles).
+- Tests compile with ASan + UBSan — no memory leaks, no undefined behavior.
+
+## Patterns to follow
+
+- **Store tests**: See `tests/test_store_nodes.c`, `tests/test_store_edges.c` — open a temporary in-memory store, perform operations, assert results, close store.
+- **Pipeline tests**: See `tests/test_pipeline.c` — write source to a temp file, run pipeline passes, query the resulting graph.
+- **Extraction tests**: See `tests/test_extraction.c` — parse source with tree-sitter, verify extracted functions/classes/calls.
+- **MCP tests**: See `tests/test_mcp.c` — construct JSON-RPC requests, call handlers, verify JSON responses.
+- **Foundation tests**: See `tests/test_arena.c`, `tests/test_hash_table.c` — unit test data structures directly.
+
+## Build and run
+
+```bash
+scripts/test.sh                       # Full suite with sanitizers
+make -f Makefile.cbm test-foundation  # Foundation tests only (fast)
+```

.claude/agents/security-reviewer.md

@@ -0,0 +1,20 @@
+You are a security reviewer for a pure C11 codebase that implements an MCP server.
+
+## What to check
+
+1. **Dangerous calls** — Any new `system()`, `popen()`, `fork()`, `exec*()`, or network calls must be listed in `scripts/security-allowlist.txt`. Flag any that are missing.
+2. **Buffer safety** — Look for unbounded `strcpy`, `sprintf`, `strcat`, `gets`. All should use bounded variants (`strncpy`, `snprintf`, arena-allocated buffers).
+3. **SQL injection** — All queries in `src/store/store.c` must use parameterized statements (`sqlite3_bind_*`). Flag any string-concatenated SQL.
+4. **Prompt injection** — MCP tool handlers in `src/mcp/mcp.c` must validate and sanitize all user-provided input before including it in responses or graph queries.
+5. **Memory safety** — Check for use-after-free, double-free, null dereference, and uninitialized reads. The project uses arena allocators (`src/foundation/arena.c`) — verify allocations go through arenas where appropriate.
+6. **NOLINT usage** — Any `// NOLINT` suppression must be whitelisted in `src/foundation/recursion_whitelist.h`. Flag unwhitelisted suppressions.
+7. **Integer overflow** — Check size calculations, especially in allocation paths and buffer length computations.
+
+## How to verify
+
+Run the 8-layer security audit:
+```bash
+make -f Makefile.cbm security
+```
+
+Review `scripts/security-allowlist.txt` for the current allow-list of dangerous calls.

.claude/settings.json

@@ -0,0 +1,26 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if echo \"$CLAUDE_FILE_PATH\" | grep -qE '\\.([ch])$'; then clang-format -i \"$CLAUDE_FILE_PATH\"; fi"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if echo \"$CLAUDE_FILE_PATH\" | grep -qE '(vendored/|internal/cbm/grammar_)'; then echo 'BLOCKED: Do not edit vendored or generated grammar files' >&2; exit 1; fi"
+          }
+        ]
+      }
+    ]
+  }
+}

.claude/skills/add-language/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: add-language
+description: Guide through adding or fixing language support (tree-sitter extraction + pipeline passes)
+disable-model-invocation: true
+---
+
+# Adding Language Support
+
+Language support has two layers. Determine which type of language you're adding:
+
+## Standard Languages (need tree-sitter grammar)
+
+1. **Add grammar** — Vendor the tree-sitter grammar into `internal/cbm/grammar_<lang>.c` using `scripts/vendor-grammar.sh`
+2. **Configure node types** — Add language entry in `internal/cbm/lang_specs.c` with AST node types for functions, classes, calls, imports
+3. **Write extractor** — Create `internal/cbm/extract_<lang>.c` for language-specific extraction logic
+4. **Add enum** — Add `CBM_LANG_<LANG>` to `internal/cbm/cbm.h`
+5. **Hook into pipeline** — Update `src/pipeline/pipeline.c` for call resolution, usage tracking
+6. **Add tests**:
+   - `tests/test_extraction.c` — AST extraction regression tests
+   - `tests/test_pipeline.c` — Integration-level pipeline tests
+
+## Infrastructure Languages (Dockerfile, K8s, etc. — no new grammar needed)
+
+Follow the **infra-pass pattern**:
+
+1. **Detection helper** — Add `cbm_is_<lang>_file()` in `src/pipeline/pass_infrascan.c`
+2. **Enum value** — Add `CBM_LANG_<LANG>` in `internal/cbm/cbm.h` and row in `lang_specs.c`
+3. **Custom extractor** — Write extractor returning `CBMFileResult*` (reuse YAML grammar if applicable)
+4. **Pipeline pass** — Register in `pipeline.c`
+5. **Tests** — Follow `TEST(infra_is_dockerfile)` and `TEST(k8s_extract_manifest)` patterns in `tests/test_pipeline.c`
+
+## Verification
+
+```bash
+scripts/test.sh          # Full test suite
+scripts/lint.sh          # Must pass all linters
+```
+
+Test against a real open-source repo that uses the language.

.claude/skills/security-audit/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: security-audit
+description: Run the full 8-layer security audit and analyze results
+---
+
+Run the 8-layer security audit:
+
+```bash
+make -f Makefile.cbm security
+```
+
+Analyze the output. The 8 layers are:
+
+1. **Static allow-list audit** — Checks for dangerous calls (`system`, `popen`, `fork`, network) not in `scripts/security-allowlist.txt`
+2. **Binary string scan** — Searches compiled binary for suspicious strings
+3. **UI audit** — Validates embedded frontend assets
+4. **Install audit** — Checks install scripts for unsafe operations
+5. **Network egress test** — Verifies no unauthorized network access
+6. **MCP robustness (fuzz)** — Sends malformed JSON-RPC to test input handling
+7. **Vendored dependency integrity** — Verifies vendored source checksums
+8. **Frontend integrity** — Checks graph-ui build artifacts
+
+For each failure, explain what the layer checks, why it failed, and how to fix it. If a new dangerous call is intentional, guide adding it to `scripts/security-allowlist.txt`.

.github/workflows/_build.yml

@@ -81,7 +81,7 @@ jobs:
           tar -czf codebase-memory-mcp-ui-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz \
             -C build/c codebase-memory-mcp LICENSE install.sh
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}
           path: "*.tar.gz"
@@ -130,7 +130,7 @@ jobs:
           cp "$BIN" codebase-memory-mcp.exe
           zip codebase-memory-mcp-ui-windows-amd64.zip codebase-memory-mcp.exe LICENSE install.ps1
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-windows-amd64
           path: "*.zip"
@@ -181,7 +181,7 @@ jobs:
           tar -czf codebase-memory-mcp-ui-linux-${{ matrix.arch }}-portable.tar.gz \
             -C build/c codebase-memory-mcp LICENSE install.sh
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-linux-${{ matrix.arch }}-portable
           path: "*.tar.gz"

.github/workflows/_soak.yml

@@ -59,7 +59,7 @@ jobs:
         run: scripts/soak-test.sh build/c/codebase-memory-mcp ${{ inputs.duration_minutes }}
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: soak-quick-${{ matrix.goos }}-${{ matrix.goarch }}
           path: soak-results/
@@ -92,7 +92,7 @@ jobs:
           scripts/soak-test.sh "$BIN" ${{ inputs.duration_minutes }}
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: soak-quick-windows-amd64
           path: soak-results/
@@ -141,7 +141,7 @@ jobs:
         run: scripts/soak-test.sh build/c/codebase-memory-mcp 15
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: soak-asan-${{ matrix.goos }}-${{ matrix.goarch }}
           path: soak-results/
@@ -179,7 +179,7 @@ jobs:
           scripts/soak-test.sh "$BIN" 15
       - name: Upload metrics
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: soak-asan-windows-amd64
           path: soak-results/

.github/workflows/release.yml

@@ -124,7 +124,7 @@ jobs:
           "
 
       - name: Attest SBOM
-        uses: actions/attest-sbom@bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b # v2
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
         with:
           subject-path: '*.tar.gz'
           sbom-path: 'sbom.json'
@@ -152,7 +152,7 @@ jobs:
           git tag -f "$VERSION"
           git push origin "$VERSION" --force
 
-      - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
+      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
         with:
           tag_name: ${{ inputs.version }}
           draft: true

.gitignore

@@ -33,13 +33,20 @@ Thumbs.db
 
 # MCP config (user-local, generated by install command)
 .mcp.json
-
+./.claude/settings.json
+./.claude/agents/*
+./.claude/skills/*
+./.claude/worktrees/*
 # MCP Registry auth tokens
 .mcpregistry_*
 
 # Local project memory (Claude Code auto-memory)
 memory/
 reference/
+.remember/
+
+CLAUDE.md
+docs/superpowers/
 
 # Build artifacts
 build/