64-bit hygiene: string length into the base module, wider memcpy/memcmp, and three rules that catch the truncation

[borisbat]

Five related pieces of 64-bit hygiene, plus the tooling fix that made the rest safe to work on.

1. length on a string moves to the base module

This did not compile:

options gen2
[export] def main() {
    let s = "hello"
    print("{length(s)}\n")   // error: no matching function
}

...while empty(s) right next to it did. empty was already a base-module builtin; length was in strings. That split is arbitrary — the two belong together. Both string length overloads now bind in the base module beside empty, and the snippet above compiles.

The declarations move from aot_builtin_string.h to aot_builtin.h. That part is forced: a script can now reach length with no require at all, so AOT output for it does not include the strings header, and the declaration has to live in one that is always pulled in via aot.h. Verified by generating AOT for a script with and without require strings and diffing the include list.

require strings keeps working unchanged — base-module symbols are always visible, so nothing needed a re-export, and adding one would have made every call ambiguous.

2. The 64-bit surface those expose

• long_length(string) / long_length(das_string). long_length previously covered only array and table. Without this, moving length would have left int64(length(str)) with no correct replacement for the new lint to suggest. Note stringLength() is itself uint32_t(strlen(...)), so these use strlen directly rather than reusing it.
• memcpy and memcmp over uint, int64, uint64, plus the const-source twins AOT needs. das has no implicit promotion, so without these a size that is already 64-bit could only reach memcpy through a narrowing cast.

The int-returning string lengths now carry the same always-on DAS_VERIFYF guard that array and table length already use, so a string past 2^31 stops instead of returning a wrapped negative. No Context threading was needed — the existing array/table guards showed the pattern.

Signatures of the two pre-existing C++ functions are unchanged, so embedders calling them directly keep compiling.

3. LINT017 — 64-bit cast of a call with a long_ counterpart

let n = int64(length(arr))   // wraps at 2^31 BEFORE the cast runs
let n = long_length(arr)     // 64-bit throughout

The inner call returns int, so the truncation has already happened by the time the widening cast executes. The cast looks like it buys range and buys nothing.

The pair table is hardcoded deliberately. An "exists" check is not meaningful for user functions — a macro can add or remove them mid-compile — so the only well-defined domain is the builtin/daslib set, which is enumerable. Each pair is additionally gated on the receiver type, which is what keeps a same-named user overload silent, along with the fixed-array length generic in daslib/builtin.das that genuinely has no long_ twin.

4. LINT018 — narrowed memcpy / memcmp size

Now that (2) added the wider overloads, an int(...) cast on the size argument is pure loss:

unsafe(memcpy(dst, src, int(nbytes)))   // nbytes : int64 — truncates past 2GB
unsafe(memcpy(dst, src, nbytes))

Both LINT017 and LINT018 are LINT rather than PERF: this is code not handling 64 bits correctly, not code that is merely slow.

5. STYLE036 — inert type contract on a cast target

-const, -&, -[], -#, ==const and ==& are substitution contracts. They do work only while a generic binds — void? is void? regardless of -const.

What makes this exact rather than heuristic: inference clears a contract when it consumes one (ast_typedecl.cpp:223,422). So a flag still set at lint time is itself proof the contract was never consumed. The generic case removes its own evidence.

The one exclusion is an auto or still-unresolved alias target, where substitution has not run yet — linq's reinterpret over ARGT -const really does strip const. Adding that exclusion took the daslib hit count from 179 to 5. A concrete typedef is not such a case: with typedef CI = int const, casting to CI? -const keeps the const, so the contract is inert there too and the rule correctly fires. That was established by probing describe() output post-inference, not assumed.

6. MCP grep_usage fix (why it is in this PR)

resolve_path(".") returned the repo root with a trailing /. appended, and ast-grep cannot relativize candidate paths against a root spelled that way. Every --globs pattern containing a / silently matched nothing and reported "Found 0 matches" — indistinguishable from a genuine no-usages answer. Basename and **/-prefixed globs were unaffected, which is why no existing test caught it.

Three of the rules above are search-heavy, so this was fixed first rather than working on top of a search that silently lies.

What the new rules found

Everything they flagged in daslib/ is fixed here: 5 STYLE036 (dead -const on concrete reinterpret targets), 2 LINT017 (genuine truncation in debug.das / debug_eval.das), and 2 STYLE030 — require strings entries that existed only for length(str) and became unused once it moved. daslib/ lints clean.

Repo-wide the rules find 172 LINT017, 79 LINT018, and only 3 STYLE036 outside daslib. Spot-checked and real, e.g. memcpy(..., int(dim)) with dim : int64 in dasLLAMA and int64(length(take)) in the dictate example. These are pre-existing and untouched here — CI lints changed files only, and for scale the same sweep reports 4908 pre-existing PERF020. They will be picked up as those files are next edited.

Testing

Fixtures under utils/lint/tests/ for each rule (auto-skipped by the lint runner, so intentional violations do not trip the gate), and a grep_usage regression test that fails on the exact silent-zero glob.

preflight --full came back 13 passed / 3 failed; all three were local-environment artifacts, fixed and re-validated with the targeted gates:

• docs/sphinx-latex + docs/sphinx-html — myst_parser was missing from the local Sphinx env (and installed against the wrong interpreter on the first attempt). Both builders re-run clean with -W --keep-going.
• tests-aot — error[50101], and the hash list in the diagnostic named the very methods this PR adds to LintVisitor. Editing daslib does not invalidate per-test _aot_generated stubs, so they still encoded the old class hash. Wiped all 91 stub dirs and rebuilt the full test_aot (1344 TUs, 0 errors) — tests-aot and tests-interp then both pass. CI builds from a fresh checkout and cannot hit this; skills/aot_hash_desync_debugging.md gains a note that preflight does not wipe for you, plus the tell for distinguishing staleness from a real desync.

Pushed with --no-verify, which is the documented path in skills/make_pr.md for a failed run (fix → targeted re-validation → announced no-verify) rather than burning a second full run.

Known gap

STYLE035 has no section in lint.rst — pre-existing drift, not introduced here, and left alone to keep this diff on topic.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves 64-bit correctness and ergonomics across daslang’s core surface area by moving string length into the base module, adding 64-bit memcpy/memcmp overloads, and introducing new lint/style rules (with docs) to detect common truncation and inert-type-contract patterns. It also fixes an MCP grep_usage path-normalization bug that could silently zero results when using slash-anchored glob filters.

Changes:

• Move string length/long_length builtins into the base runtime module (next to empty) and adjust AOT headers accordingly.
• Add wider memcpy/memcmp overloads (uint/int64/uint64) and new lint rules (LINT017/LINT018) + style rule (STYLE036) with documentation updates.
• Fix MCP grep_usage root handling and path normalization; add a regression test.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
utils/mcp/tools/grep_usage.das	Stops using resolve_path(".") as default search root; uses get_das_root() to avoid /. root spelling.
utils/mcp/tools/common.das	Normalizes resolved paths to avoid /. and duplicate separators impacting ast-grep glob matching.
utils/mcp/test_tools.das	Adds regression test ensuring slash-anchored glob filters don’t silently zero results.
utils/lint/tests/style036_inert_cast_modifier.das	Adds a fixture file demonstrating STYLE036 cases (lint fixture directory is skipped by the lint tool).
utils/lint/tests/lint018_mem_size_narrowing.das	Adds a fixture file demonstrating LINT018 cases.
utils/lint/tests/lint017_long_counterpart_cast.das	Adds a fixture file demonstrating LINT017 cases.
src/builtin/module_builtin_string.cpp	Removes registration/defs for string length from the strings module.
src/builtin/module_builtin_runtime.cpp	Registers string length/long_length in the base module; adds wider memcpy/memcmp extern overloads.
skills/style_lint.md	Documents the new STYLE036 rule in the style lint skill page.
skills/strings.md	Updates string-skill guidance to reflect length/empty living in the base module.
skills/aot_hash_desync_debugging.md	Adds guidance about local _aot_generated staleness vs real AOT hash desync.
install/CLAUDE.md	Updates shipped instructions to reflect base-module string length/empty and new lint/style rules.
include/daScript/simulate/aot.h	Adds AOT helper overloads for das_memcpy/das_memcmp with uint/int64/uint64 sizes (+ const-source variants).
include/daScript/simulate/aot_builtin.h	Declares base-module string length/long_length functions for AOT output.
include/daScript/simulate/aot_builtin_string.h	Removes string length decls from strings-specific AOT header.
doc/source/reference/language/lint.rst	Documents LINT017, LINT018, and STYLE036 in the reference docs.
daslib/style_lint.das	Implements STYLE036 detection for inert cast-target contracts.
daslib/lint.das	Implements LINT017 (prefer long_ twins over widening casts) and LINT018 (avoid narrowing memcpy/memcmp sizes).
daslib/flatten_opt_preshade.das	Removes inert -const from reinterpret target per STYLE036 intent.
daslib/flatten_opt_common.das	Removes inert -const from reinterpret targets per STYLE036 intent.
daslib/delegate.das	Drops require strings now that length is base-module accessible.
daslib/debug.das	Fixes an identified truncation pattern by using long_length instead of widening length.
daslib/debug_eval.das	Fixes an identified truncation pattern by using long_length instead of widening length.
daslib/async_boost.das	Drops require strings now that length is base-module accessible.
daslib/array_boost.das	Removes inert -const from reinterpret target per STYLE036 intent.
CLAUDE.md	Updates repo instructions to reflect base-module string length/empty and new lint/style rules.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[borisbat]

CI round 1: 36/37 green, one real failure — extended_checks (windows, 64), and it was mine.

test_resolve_load_modules_absolutizes_relative broke because of the normalize() I had added to the shared resolve_path. lexically_normal() rewrites every separator to the platform-preferred one, so on Windows it turned the forward slashes of get_das_root() into backslashes and the test's "result contains the root as a substring" invariant stopped holding. path_join only ever appends a separator — my original reasoning that the two merely round-trip through std::filesystem::path::string() was wrong, and it happened to be invisible on macOS where both spellings agree.

Fixed in b57426e by shrinking the change rather than patching around it: resolve_path reverts to exactly its previous behaviour (with a comment recording why it must not normalize), and grep_usage maps both spellings of "the repo root" — "" and "." — straight to get_das_root(). That is all the original silent-zero bug ever needed; the helper's other 25 call sites are untouched now.

Added a test for the "." spelling next to the existing empty-directory one. Locally: test_tools 419/419, test_crosstree_guard 11/11, and the original failing glob still returns its 100 matches.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

utils/mcp/tools/common.das:528

• resolve_path()’s new comment says normalize() is avoided because it would rewrite separators on Windows and break comparisons against get_das_root(), but resolve_path already calls path_join(), whose C++ implementation uses std::filesystem::path(...).string() (native separators). If get_das_root() is in generic / form, resolve_path still risks returning \ paths on Windows. Consider converting the joined path back to generic form (and update the comment accordingly).

    // Deliberately NOT normalize()d: lexically_normal rewrites every separator to the
    // platform preferred one, so on Windows it would turn the forward slashes of
    // get_das_root() into backslashes and break callers that compare against it.
    return path_join(get_das_root(), path)

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated no new comments.

[borisbat]

CI round 2 on 32b3efa2: 35 pass / 0 fail / 4 skip — green. The 4 skips are the nightly-only Windows toolchains (mingw, clang-cl, and the two *_nightly cells), which are gated off per-PR by design.

Two corrections to the description above, both from this round:

• §3's code comment reads // wraps at 2^31 BEFORE the cast runs. More precisely: the cast widens an already-32-bit result, so the limit is reached inside the callee — as a wrap for count / find_index, or as the always-on panic guard for array/table/string length/capacity that §2 adds. Copilot caught the diagnostic saying "wraps" for cases this PR makes panic; fixed in 32b3efa2 across the message, fixture, lint.rst and both CLAUDE.md rows.
• §6 describes the bug correctly, but the fix is narrower than the first push: resolve_path is unchanged, and only grep_usage maps "" / "." to get_das_root(). The intermediate version hardened resolve_path with normalize() and broke extended_checks (windows, 64) — see the comment above.