v0.5.2-beta

🔧 codebadger — v0.5.2-beta

Feature + hardening release on top of v0.5.1-beta. Adds caller-supplied C/C++ build options (with auto include-detection), makes the CPG cache key correct for build options and remote branches, fixes two query-output corruption bugs, and rebuilds the integration test corpus into a realistic codebase that exercises the detectors end-to-end.

No breaking changes from v0.5.1-beta.

✨ New

• C/C++ build options on generate_cpg. New optional include_paths and defines parameters are passed through to c2cpg. Without them, angle-includes of generated headers (e.g. <libxml/xmlversion.h>) don't resolve and feature macros stay undefined, so #ifdef-gated modules are silently dropped from the CPG. Entries are validated/normalized first (_sanitize_build_opt_list): control characters are rejected and relative include paths may not contain .. (so a joined path can't escape the source root); absolute paths pass through.
• Automatic include-dir discovery. When no include paths are supplied, _autodetect_c_includes seeds a lightweight C/C++ search path — the source root, any include/ directory, and any directory that directly contains config.h or a generated *version*.h — so common angle-includes resolve out of the box.

🩹 Fixes

• run_cpgql_query char-explosion. Query normalization now parenthesises the base query before appending .take/.toJsonPretty/.toString. Previously a ++ chain (e.g. a.l ++ b.l ++ c.name.toJsonPretty) bound the tail to its last operand only, so the result came back as an exploded String instead of JSON. Queries that already self-emit (a <codebadger_result> envelope, or an explicit .toJson/.toJsonPretty/.toString tail) are left untouched.
• get_variable_flow output corruption. The variable-flow query emits a self-delimiting <codebadger_result>…</codebadger_result> envelope that _parse_output extracts; the executor no longer wraps/trims its tail, which had been corrupting the payload.

🔁 Cache correctness

• Build options are part of the cache key. Caller-supplied include paths / defines change the produced CPG, so they're now folded into the cache key — two builds of the same source with different c2cpg flags no longer collide on one graph.
• Remote branch is part of the cache key. For github sources a requested branch now keys the CPG, so two branches of the same repo can't collide (the second request previously reused the first branch's graph). Default branch (None) leaves the key unchanged for back-compat.

🐳 Containerized MCP

• Host-path resolution for containerized deployments. resolve_host_path(host_path, require_local_access=True) underpins local sources. When the MCP is containerized and the path lives on the host filesystem, the caller copies the tree via a host-daemon helper container and passes require_local_access=False to skip local existence checks (the helper validates existence on the host instead).

🧪 Test corpus & integration coverage

• Realistic analysis fixture. playground/codebases/core was rewritten from a labelled sample collection into a comment-free, OSS-style lightweight VMM (microvm): virtio device emulation, a DMA/guest-RAM controller, a vsock/QMP monitor, INI config, and command handling. Telegraphing names (vuln_*, *_unsafe, *_untrusted, memory_process_untrusted, safe_str*, …) are gone, so detectors must rely on program analysis rather than naming.
• Tricky + edge cases. Each detector now has a true-positive site paired with a precision (true-negative) variant — e.g. dma_ring_resize (malloc(count * sizeof …), HIGH) vs dma_ring_resize_guarded (__builtin_mul_overflow + bound); double-free on a shared path vs mutually-exclusive branches; UAF via interprocedural free + returned dangling pointer vs free-then-reassign; size-mismatch memcpy vs bounds-checked copy; a config_open_checked access→open TOCTOU; and interprocedural recv → system taint.
• Expanded integration suite. New cases cover integer overflow, TOCTOU, null-pointer dereference, uninitialized reads, interprocedural taint flow, and a function-pointer/static callback-chain call graph, alongside the existing UAF / double-free / format-string / heap- & stack-overflow / call-graph / CFG / taint-source/sink tests. Validated live against a running server: 28/28 detector checks pass on the new corpus.
• Unit tests added for cache-key generation, query normalization, build-option validation, host-path resolution, source fingerprinting, and C include auto-detection.