v0.6.0-beta

🦡 codebadger — v0.6.0-beta

Agent-usability release on top of v0.5.1/v0.5.2-beta, driven by feedback from a large agent-run across ~70 C/C++ CVEs. The analysis primitives were already solid; this release closes the gaps that actually slowed agents down — truthful build/load state (no more silent hangs or invisible empties), better coverage (indirect dispatch, gated code, large repos), and a set of frontend-aware build options so high-fidelity parsing is one parameter (or zero) away.

No breaking changes from v0.5.x.

🔭 Truthful state in get_cpg_status

• generating timeout reconciliation. A build whose worker died (process restart, OOM kill, lost in-memory job) no longer sits in generating forever. Each build stamps a deadline (generation_timeout + generation_deadline_grace); a status poll past the deadline with no live worker is reconciled to FAILED with error_code=GENERATION_TIMEOUT. A still-queued/running build is never condemned (the liveness probe fails safe).
• Progress telemetry. Responses now carry phase (queued→frontend→loading→ready), elapsed_seconds, deadline_seconds (remaining budget), and queue_position — so a poller can tell "queued behind others" from "actively parsing" from "wedged" instead of staring at a bare status.
• Coverage sanity check. user_method_count (the verified user-defined method count from load) is surfaced, so a near-empty build is obvious immediately.
• codebase_label. A stable, non-sensitive <project>@<short-hash> ties a hash back to what it built, despite redacted paths.

🛠️ New tool: get_backend_status

Read-only backend introspection for self-pacing: build_workers, recommended_max_concurrent_builds, queue depth / in-flight, active vs. max Joern servers, the memory-admission ledger, cpgs_on_disk / disk_mb, and a per-CPG list. Agents (and orchestrators) can now size their fan-out instead of melting the backend by trial and error.

🧩 Coverage gaps closed

• Indirect / virtual / callback callers. When get_call_graph(..., incoming) finds 0 direct edges, it now surfaces every site that takes the method's address (function pointer, callback registration, vtable entry) as the likely caller — turning dead-ends (png_safe_execute, libtiff img->put, registered read callbacks, …) into leads. Clearly labelled as a heuristic.
• Gated-body warnings. get_call_graph / get_program_slice / get_variable_flow now warn when the target method resolves but has no body (0 calls, ≤1-line span — the #ifdef/feature-gated signature), pointing at defines=[…] / include_paths=[…] instead of silently returning empty.
• Slice token budget. get_program_slice clips per-node code (one macro-expanded statement could blow the response) and caps node counts with an explicit TRUNCATED note, so a macro-heavy sink no longer forces the agent to abandon the slice.

⚙️ Frontend-aware build options on generate_cpg

Every new flag is gated by a per-frontend capability table (FRONTEND_CAPABILITIES), so a flag is passed only to a frontend that accepts it — handing a C-only flag to pysrc2cpg/jssrc2cpg/… can no longer crash a build. (--exclude-regex is universal; --include/--compilation-database/auto-discovery are c2cpg-only; --define is c2cpg + swift.)

• include_globs — scoped large-repo builds (all languages). Analyze a subset of a big repo (['libavcodec/**','libavutil/**']) without re-rooting source_path and losing cross-directory header/macro resolution. The repo root stays the parse base; only out-of-scope source TUs are skipped — headers stay includable.
• auto_system_headers (C/C++, opt-in). Enables c2cpg --with-include-auto-discovery so libc/STL headers resolve and stop dropping whole files / gated bodies when coverage looks thin.
• compile_commands (C/C++) — highest fidelity, with auto-detect. Point at a compile_commands.json for exact per-file -I/-D/-std. The DB's absolute build-machine paths are auto-rebased onto the analyzed copy. If you don't pass one, a compile_commands.json shipped in the source (root/build//out//…) is detected and used automatically (CPG_AUTODETECT_COMPILE_DB, default on). Best-effort: if it can't be applied the build proceeds and logs why.

💾 Lifecycle & resource hygiene

• Load-size guard (2 GB). A built cpg.bin above CPG_MAX_LOAD_MB (default 2048) fails fast with CPG_TOO_LARGE and scoping guidance, instead of the opaque "failed to reload into a Joern server" after a long stall.
• Cold-CPG GC (evict-only). A background sweep releases the allocations (server process, port, memory reservation) of CPGs gone cold and marks them SLEEPING; the cpg.bin is kept on disk and reloads transparently on the next query. Disk deletion is strictly opt-in (CPG_GC_DELETE_COLD, default off).

🐳 Containerization

• Docker networking for pooled workers. Joern server/worker networking hardened so pool workers can be reached by container name on an internal Docker network (no published host port required).

✅ Quality

• New unit + integration coverage for status reconciliation/progress, get_backend_status, the gated/indirect/slice query changes, frontend capability gating, include_globs scoping, and compile_commands rebasing/auto-detect. The query changes were also validated live against a running Joern (gated warning, indirect-caller, slice, and scoping all confirmed end-to-end).