[taylorg009]

Problem

On bin-v0.8.3, cgraph seam fuse --seam ... --graph ... --out <dir whose parent is read-only> aborts with a core dump:

terminate called after throwing an instance of 'std::filesystem::__cxx11::filesystem_error'
  what():  filesystem error: cannot create directories: Permission denied [/tmp/.../read-only/out]
exit 134

#173 made main catch cgraph::FileWriteError, but std::filesystem::create_directories (and any other exception) still escaped. graphd, cgraph-client and cgraph-mcp had no handler at all.

Fix

• atomic_write: new create_output_directories(dir). It throws FileWriteError with the same message style as fix(io): fail loud when an output file cannot be written whole #173: failed to write <dir>: cannot create directory (Permission denied). It is used by the CLI output paths (build, seam gen/discover/fuse), write_exports, write_semantic_stat_index and write_semantic_cache. The daemon callers of the last two already log FileWriteError as non-fatal (persist_stat_index, the semantic cache write in daemon_server.cpp), so a directory failure there no longer kills graphd either.
• cli/main: a single std::exception handler prints cgraph: <what> and exits 1. That covers FileWriteError, filesystem_error (its what() names the path) and anything else.
• graphd, cgraph-client, cgraph-mcp: each gets the same last-resort handler (<tool>: <what>, exit 1).
• mcp_server: if the forwarder throws, only that request fails, with JSON-RPC -32603 carrying the message. The stdio loop keeps running. Before this change only graph_change_context was caught.

Graph output is unchanged and kIndexVersionKey is not bumped.

Evidence

The new cli_main_test case was run against the released binary (bin-v0.8.3, revision 269048a; there is no src/ or tests/ diff from 269048a to main):

FAIL: seam fuse into a read-only parent exits 1 (got 134): terminate called after throwing an instance of 'std::filesystem::__cxx11::filesystem_error'
FAIL: one-shot build into a read-only parent exits 1 (got 134): ...
exit=1

The same test against this branch prints cli_main_test: ok (exit 0).

mcp_server_test with the mcp_server.cpp hunk reverted aborts with terminate called ... cannot create directories: Permission denied [/ro/daemon-dir] (exit 134). With the fix it exits 0.

Manual end-to-end runs, released binary vs this branch:

command	bin-v0.8.3	this branch
graphd --root /tmp --idle-timeout abc	134, terminate ... stoll	1, graphd: stoll
cgraph-client status from a deleted cwd	134	1, cgraph-client: filesystem error: cannot get current path: No such file or directory
cgraph-mcp from a deleted cwd	134	1, cgraph-mcp: filesystem error: cannot get current path: ...

Full suite: ctest --test-dir build/default -j6 passed 95 of 96. The one failure is cgraph_file_watcher_test, which is a known local failure on this host.

Review round 1

1. graphd exception safety (src/engine/daemon_server.cpp)

• If the serve loop, the initial-build thread or the enrichment worker throws, the exception is now logged with its type (graphd: <where> failed: <type>: <what>). The daemon then stops and run_daemon_server returns 1.
• A ScopeExit guard joins both workers, closes the listen socket and runs cleanup_daemon_endpoint on every exit path. Nothing unwinds past a joinable std::thread any more.
• Each connection is closed by its own guard.
• The exit-time incremental persist is skipped after a failure, because the index may be half-updated.
• Most of this file's diff is re-indentation from wrapping the loop in try. Review with git diff -w.
• Test, daemon_server_test: the root's parent loses search permission, so weakly_canonical(root) throws filesystem_error. This is tested twice: from an update (serve loop) and from the initial build (build thread). Before the fix the test aborts (exit 134, terminate called ... status: Permission denied [/tmp/cgraph_daemon_fatal_test/proj]). After the fix it exits 0, and both cases return 1 with the endpoint removed.

2. cgraph-mcp malformed lines (src/mcp/mcp_server.cpp)

• handle_mcp_request catches nlohmann::json::exception and answers -32600 with id: null. It does this per request, so the stdio loop keeps serving.
• Test, new mcp_main_test: it pipes 5, [1] and {"jsonrpc":"2.0","id":3,"method":7} into the real cgraph-mcp, followed by tools/list.
  • Before the fix: cgraph-mcp: ... type_error.306 ... cannot use value() with number, exit 1, and no responses.
  • After the fix: four responses, and tools/list is still answered.
• mcp_server_test also checks these shapes, which abort before the fix.

3. Numeric flags (new cgraph/cli_support)

• One shared set of helpers replaces every stoi/stoll/stod/stol in src/cli/main.cpp and graphd's --idle-timeout: parse_integer<T>, integer_flag<T> and number_flag. They use from_chars for integers and strtod for numbers, because macOS libc++ lacks floating-point from_chars.
• A bad value exits 2 with, for example, cgraph: --depth expects an integer, got 'abc' or graphd: --idle-timeout expects an integer, got 'abc'.
• stats --since reuses parse_integer, so 5xh is now rejected; stol used to read it as 5.
• change-context keeps its JSON error output and now exits 2 for a bad flag.
• Test: cli_main_test runs report modules --depth abc.
  • bin-v0.8.3: exit 134 (what(): stoi).
  • Round 0 of this PR: exit 1 (cgraph: stoi).
  • Now: exit 2 with the message above.
• cli_support_test covers the helpers.
• This supersedes the graphd --idle-timeout abc row in the table above: it now exits 2 with the usage message.

4. Last-resort handlers

• describe_exception adds the demangled type, for example std::out_of_range: map::at.
• It is used by the std::exception handlers in cgraph, graphd, cgraph-client and cgraph-mcp.
• FileWriteError keeps fix(io): fail loud when an output file cannot be written whole #173's plain message.

5. atomic_write_test

• create_output_directories is now covered for an empty path (no-op), an existing directory, nested creation, and a read-only parent. The read-only case must throw FileWriteError with exactly failed to write <dir>: cannot create directory (Permission denied).

Verification

• Full suite: 97 of 98 pass. The one failure is cgraph_file_watcher_test, which is a known local failure.
• origin/main is merged in (already up to date at d526ca8).

Review round 2

1. Blocker, macOS test failure (tests/smoke/cli_support_test.cpp): the filesystem_error case now checks only for filesystem_error: and [/x]. libc++ names the type std::__1::__fs::filesystem::filesystem_error. The std::out_of_range: check is unchanged. I could only verify on Linux (cli_support_test: ok); the macOS fix is verified by CI only.
2. MCP id echo (src/mcp/mcp_server.cpp): an Invalid Request now returns the request's id when the request is an object and its id is a string, number or null. Otherwise the id is null.
   • mcp_main_test expects null, null and 3 for 5, [1] and {"jsonrpc":"2.0","id":3,"method":7}.
   • mcp_server_test also covers a string id and an object id (which gets null).
   • With the previous mcp_server.cpp the test fails: FAIL: malformed line 3 answered with Invalid Request, id 3: {..."id":null...}. With the fix it prints mcp_main_test: ok.
3. MSVC build (src/engine/cli_support.cpp): <cxxabi.h> and __cxa_demangle are now guarded by #if !defined(_MSC_VER). MSVC uses typeid(...).name(), which is already readable there.

Note on number parsing: from_chars rejects a leading + that stoi accepted. cgraph report modules --depth +5 now prints cgraph: --depth expects an integer, got '+5' and exits 2.

Verification: the full suite passes 97 of 98. The one failure is cgraph_file_watcher_test, which is a known local failure. origin/main is merged in (already up to date).

🤖 Generated with Claude Code

[github-actions]

PR brief: 0 agent commits · run the full suite

Warning

Run the full suite. The graph cannot vouch for this diff, so every test file is selected. Nothing is skipped; this is the safe default, not a failure.

2 files have no graph node (config, asset, or unextracted).

If these files cannot change which tests should run, add a pattern for them to ignore. If they feed tests (fixtures, data), this outcome is correct.

src/engine   ████████████████████████  1
tests/smoke  ████████████████████████  1

All 2 unmapped files

src/engine/CMakeLists.txt
tests/smoke/CMakeLists.txt

Computed at 918dc77 against base 7bb2413.

Summary	PR #179
Intent	no checkpoints on this branch (4 commits)
Since push e4d09b5	1 new commit, 0 changed files, 0 tests reached

What each commit did

Commit	Intent	Files	Reaches	Ran before push
4e04d24 fix(cli): exit 1 instead of aborting on uncaught filesystem…	no checkpoint	12 files
12a7183 fix: review round 1 -- daemon/MCP exception safety, numeric…	no checkpoint	16 files
36f5786 fix: review round 2 -- portable demangle test, echo readabl…	no checkpoint	5 files
918dc77 fix(atomic-write): name the OS reason from the error_code o…	no checkpoint	1 file

Claims checked

no checkpoint on this branch makes a claim the graph can check

_{blastline 0.13.0. Selection is advisory unless your workflow gates on it. How selection works. Intent: 0 of 4 commits. Not checked: symbol changes: no --change-context given.}

[tgod009]

Independent review of the main merge (e4d09b5) plus 918dc77: NON-BLOCKING, ready to merge.

• daemon_server.cpp resolution: both workers are joined on every exit path (stop_workers is declared after build_thread and enrichment_worker, so it runs first); the endpoint is cleaned exactly once; the listener is reset only after the last accept; nothing from main (#203, #207) was dropped.
• mcp_server.cpp: listed_tools is threaded through respond() and the json-exception wrapper.
• MSVC/Windows: no unguarded POSIX calls; POSIX-only tests are skipped on Windows.
• The one SHOULD (create_output_directories naming Win32 codes as errno) is fixed in 918dc77.

CI on 918dc77: 12/12 green, including windows-default and windows-release. Local ctest: 104/104.

Note, not this PR: the earlier windows-release failure on e4d09b5 ("incremental state re-persisted to graph.json") came from "cannot rename graph.json.tmp into place: Access is denied". The test polls graph.json with an ifstream while the daemon renames over it, and Windows refuses to replace an open file. The rename code and that test loop are unchanged from main.