Bumps the github-actions group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `actions/upload-artifact` from 7.0.1 to 7.0.2
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

Updates `actions/download-artifact` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@3e5f45b...9000827)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…ocal DoS (#209)

* fix(serve): bound request-line size in handle_connection to prevent local DoS

`handle_connection` in `tgrep-cli/src/serve.rs` used
`BufReader::read_line(&mut String)` with no upper bound on how much data
it would buffer before seeing a newline. A local, unauthenticated client
that connects to the server's TCP port (discoverable via the
world-readable `serve.json`) and streams bytes without ever sending `\n`
can grow that `String` without limit, exhausting process memory
(observed: 11MB -> 2.7GB in ~2s in local testing).

This is tracked as MSRC case #162882 / ICM 31000000761603
(CWE-770: Allocation of Resources Without Limits or Throttling,
Severity: None / Security Impact: Defense in Depth / Resolution:
Informational, Plan of Action due 2026-10-25).

Notably, the managed shared-daemon protocol in
`tgrep-cli/src/serve/shared/protocol.rs` already enforces exactly this
kind of bound via its own `read_line(stream, limit)` helper, reusing
`tgrep_core::managed::MAX_REQUEST_BYTES` (1MB). The primary
`tgrep serve` connection path predates that protocol and was never
updated to match -- this fix brings it in line.

Fix: introduce `read_bounded_line`, a drop-in replacement for the
unbounded `BufReader::read_line` call, capped at the same
`MAX_REQUEST_BYTES` limit used elsewhere in the codebase. Once a peer
exceeds the limit without sending a newline (or disconnects mid-line),
the connection is dropped with an error instead of being read
indefinitely.

Tests added (`serve::read_bounded_line_tests`):
- normal line round-trip
- clean EOF handling
- multiple lines on one stream
- regression test: oversized line with no newline is rejected (the
  exact DoS pattern from the report)
- boundary test: a line exactly at the limit is still accepted
  (bound is inclusive, not off-by-one)
- a line missing its newline but under the limit is still rejected
  (no silent truncation/partial-read as a "complete" request)

All 345 existing tgrep-cli tests continue to pass; `cargo fmt --check`
is clean.

Co-authored-by: Copilot <[email protected]>

* fix(serve): reject invalid UTF-8 in request lines instead of lossily decoding

Per PR review from Copilot: String::from_utf8_lossy() silently replaces
invalid UTF-8 bytes with U+FFFD, which would let JSON parsing succeed
against a line the attacker (or a bug) corrupted -- e.g. a malformed
params.pattern silently becomes a different pattern instead of being
rejected. Switch to String::from_utf8(bytes)?, which fails the request
the same way the original read_line(&mut String) implicitly guaranteed
(std strings are always valid UTF-8).

Added a regression test with an invalid UTF-8 byte embedded in an
otherwise well-formed, newline-terminated JSON-RPC request line.

346 tgrep-cli tests pass (was 345); cargo fmt --check clean.

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

* Authenticate Windows producer reobservations before publication

Reverify closed managed members against their original bounded block proofs under native write/delete exclusion. Keep the original seal, identity and ownership checks, and charge generation verification to its existing work permit. Reject timestamp-restored rewrites and unverified reobservations; add native metadata-only and protection regressions.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d

* Keep admitted deadlines during member authentication

Reuse the existing WorkPermit deadline and checks for admitted Windows verification. Bound only unreserved observations with current policy, and cover a policy timeout reduction after admission.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d

* Account for CRLF overlay allocations by capacity

Release extraction headroom and consumed input tables instead of retaining cumulative per-posting estimates. Admit hash-table growth with old and replacement capacity both charged, preserve content and mask semantics, and cover CRLF checkpoint/refresh under the existing budget.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d

* Fix managed native watches for large worktrees

Use bounded recursive-root subscriptions on Windows and macOS while retaining per-directory accounting elsewhere. Preserve native coverage after kernel-initiated watch retirement, expose subscription counts, and cover default-budget multi-worktree events, metadata, fallback, and cleanup.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Bump workspace version to 1.2.2

Update both first-party lockfiles and release instructions; preserve historical v1.2.1 deprecation and candidate evidence.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d
Cherry-picked-from: 2f9d21f
Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Preserve overlay allocation charges across replacements and deletions

Size replacement growth after removing old entries from the unpublished clone. Track backing-capacity watermarks for retained maps, posting sets, and bookkeeping instead of releasing tombstone storage. Add deterministic red/green replacement and deletion regressions, rehash/pressure coverage, and changed-CRLF checkpoint parity.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d
Cherry-picked-from: 6627cef
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Fix bounded managed qualification handshakes

Resume collection only from an evidenced bounded continuation, preserving exact reclamation accounting and native sharing assertions. Discard epoch-proven CLI fallback scans and wait within the existing managed busy budget before comparing indexed results. Add deterministic deadline and real native Git-exclude controls, and clarify the lifecycle contracts. Production code and the sealed 4e2a2a8 candidate are unchanged.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Preserve managed collection progress across busy idle probes

Discard cached member authentication only after other shutdown blockers are clear. Preserve natural expiry, active verifier protection, and existing resource limits. Cover bounded stage reclamation, unchanged-cap readmission, restart persistence, and generated-store cleanup.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: 23051c7b-9d3c-4f54-9d4e-72897ee5a82a

* Reuse bounded sibling handles for indexed query reads

Amortize rooted ancestor opens across consecutive sibling candidates without reordering results. Reuse reconciliation readers while preserving snapshot validation, generation and root pins, final ancestor checks, query deadlines, and response limits. Keep singleton candidates on the direct rooted path.

Add local, legacy, and managed scan-parity coverage plus containment, failure-classification, and pin-lifetime regressions.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: 417710f4-d898-45a9-ade1-dd8f33592373

* Project count queries into bounded per-file results

Send the effective line-count mode to servers and omit unused matching-line payloads for both count modes. Preserve original match statistics, binary visibility, multiline line-count semantics, legacy ordinary-server rendering, and existing response limits.

Validate projected rows before scope filtering or output, and cover malformed replies, exact byte budgets, dense counts, and local/ordinary/shared route parity.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: 417710f4-d898-45a9-ade1-dd8f33592373

* Test compact counts separately from oversized content fallback

Preserve full-content response-cap rejection and compare fallback output byte-for-byte with a scan. Assert compact count replies stay on the shared daemon and preserve filename/count parity.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Keep macOS reclamation fixture within unchanged pass budgets

macOS deliberately discards verified prefixes after each truncation. Use smaller temporary stages and adjust pinned generations only on macOS, preserving pressure/recovery assertions, the 128-pass bound, all per-pass/resource limits, and the original Windows/Linux fixture inputs. A conservative-prefix model reproduces the old failure and the corrected fixture still fails against the pre-fix idle behavior.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: reproduce Linux foreign-reader lease failures deterministically

An external on-access reader that opens a verified member breaks or refuses
the collection's exclusive F_WRLCK lease. Reproduce both variants in-process
on Linux, isolated in a child test process, and assert the observed
fail-closed signatures followed by recovery once the reader is gone.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Frame typed owner-hold failures before the handshake

A typed OwnerGuard::claim failure in `tgrep shared owner-hold` was flattened
to exit 2 plus stderr text, so a supervising client could not distinguish
retryable not-committed catalog contention from an unknown failure.

Before `holding:true`, write exactly one newline-terminated
`{"ok":false,"error":...}` stdout line carrying the managed failure as
returned, then keep the existing exit status and stderr diagnostic.
Claim-file read/size/parse errors stay unclassified and unframed, and no
failure after the handshake is framed. The success handshake, guard
lifetime and SQLite writer/busy limits are unchanged.

Add CLI-boundary regressions: a held catalog writer yields a busy/catalog-io
retryable not-committed frame, and the same claim then holds and exits on
stdin EOF; a live holder yields owner-guard-already-held; an ended lifetime
yields a non-retryable stale-identity frame; malformed claims emit no frame.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Verify healthy native managed views while serving (SHARE-7)

Healthy native-watched managed views had no periodic full verification,
so a silently missed watcher notification could leave results stale
indefinitely. Once the existing --poll-interval has elapsed since a
view's last completed full pass, the scheduler now queues one ordinary
reconcile operation with verify: true, without invalidating the view.

The verification runs under the unchanged operation deadline and
CPU/input/handle budgets, reads and hashes every admitted file, and
compares membership and visibility with the published snapshot while
queries keep using it. If nothing differs it publishes nothing. The
first detected difference marks the view stale, closing readiness, and
the pass publishes a full repair. Deadline or cancellation leaves the
view ready but unverified until the next interval; other errors,
watcher uncertainty, explicit invalidation, concurrent events and stale
policy keep their fail-closed semantics.

Status adds last_verification and native verification policy fields,
and hello advertises serving-native-periodic-verification. Docs are
updated. Core tests cover unchanged availability, missed-change repair,
concurrent invalidation, read failures, cancellation and policy races.
CLI tests cover the interval boundary, mid-verification serving and
missed nested-directory repair with scan parity.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Update poll-interval help assertion for native verification

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Cover serving-verification budget failure after a detected difference

Cancellation, deadline and resource pressure keep a serving verification
ready only when it observed no difference. Add a managed regression for
both interleavings: a membership difference observed by discovery before
cancellation at a paused batch, and a content difference observed by the
full read before cancellation at publication. Both must leave the view
not ready with a full refresh required.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Add explicit content-only eligibility for managed views

Managed v2 indexes can opt out of the binary-extension filename heuristic,
so text such as an ASCII RTF .doc is indexed and searched like ripgrep. NUL
classification, ignore, hidden, size and filename rules are unchanged.

- IndexingProfile gains an optional eligibility ("content-only"); the default
  is omitted, so default keys, storage names and hello.profile are unchanged.
- Worktree verification applies the extension rule only for the default.
- Daemons advertise content-eligibility-profile; v1 leases reject it.
- `--content-eligibility content` searches use only a matching managed view.
  The client and server refuse mismatches in either direction, and the client
  scans with the requested rule. Ordinary servers and local indexes are
  bypassed. index/serve reject the flag.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Stabilize content-only refresh and retired-owner refusal assertions

Invalidation schedules automatic reconciliation even with --no-watch, so
the explicit refresh may legitimately run a full pass after the hints are
consumed; assert the preserved content-only profile instead (hint-only
processing stays covered in tgrep-core). Housekeeping can remove a
released owner record before re-hold, which reports owner-retired; both
reason codes remain stale-identity, non-retryable and not-committed.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: retain managed attach and shutdown failure diagnostics

Capture the original failed operation and one best-effort view status within its existing wait budget. Report stop-request, observed acceptance, and post-accept exit timing without changing the shared shutdown deadline. Add deterministic diagnostic-output and loopback controls; no production changes or whole-test retries.

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Exclude JSON end events from summary bytes_printed

ripgrep records each file's bytes_printed before writing its end message,
and the summary sums those per-file stats. tgrep added the end line to the
running file total after serializing it, so summary.bytes_printed exceeded
the sum of end records by every end line on scan, local-index, server and
managed v2 routes. Stop counting the end line and keep bytes_printed in the
JSON parity comparisons; only elapsed timing remains volatile.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Report actual searched-file work in remote JSON stats

Carry per-candidate work receipts from the server matching boundary, including candidates that emit no rows. Populate JSON summary searches/bytes_searched and each file's bytes without extra reads or scan-equivalent guesses. Validate receipts before output and charge them to existing shared response budgets. Keep elapsed conventions unchanged and document backend-work versus result counters.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: resolve documented preparation invalidation in native watcher attach

The native watcher test assumed every initial views.attach succeeds on its
first operation. The managed contract documents a terminal failed result with
both commitment fields not-committed, category busy, reason
view-preparation-invalidated and retryable=true; the sealed 272c059 run hit it.

Factor the managed_faults exact-state recovery helper into managed_attach.rs
with an explicit per-call-site allowance. Catalog callers keep the unchanged
catalog-io allowance and messages. The watcher call site alone permits the
exact preparation-invalidation outcome: it inspects the old operation, replays
the old token unchanged, recovers the same root/profile/pending identity, uses
a fresh token only after the old terminal result is resolved, keeps the
original 30-second deadline shared across attempts and the existing 8-attempt
ceiling, and requires one lease bound to the first operation. Any other
outcome still fails with view diagnostics. No product code changes.

Scripted controls cover recovery, rewritten replays, extra leases, exhaustion,
deadline, rejected outcomes/identity/responses and the unchanged classifier.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: inject attach preparation invalidation through real daemon path

Add a managed-test-hooks-only fault at the post-checkpoint preparation
boundary. Its bounded invalidation action advances and invalidates the real
view slot for each of three preparation attempts, producing the actual
retryable, not-committed view-preparation-invalidated operation receipt.
Production builds do not compile the action or its preparation handling.

Exercise the watcher recovery helper against a real managed daemon: verify the
failed receipt and three fault hits, then require token 2 to complete against
the same pending view and original lease, with native readiness, one lease,
indexed search, scan parity, and normal cleanup.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* fix: address Copilot review findings

Co-authored-by: Copilot App <[email protected]>

Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: accept procfs ESRCH after descendant exit

Linux procfs can report ESRCH when a task exits after its stat file is opened. Treat that observation as task disappearance in the test-only assert_dead helper while preserving live-state deadlines and unrelated errors. Cover the real open/exit/read boundary and scripted live/error observations.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: accept legal catalog Busy from guarded generation opens

open_generation takes the SQLite catalog writer lock with the fixed 250 ms
wait, so a concurrent writer can legally return retryable, uncommitted
busy/catalog-io (SHARED_WORKTREE_INDEXES.md). The legacy-reader test and the
guarded reader subprocess assumed first-attempt success with a bare unwrap.

Route both through the existing exact-class owner-claim retry helper, made
type-generic with its unchanged 10 s fixture bound and 20 ms spacing. Add a
real-boundary control that holds an owned BEGIN IMMEDIATE writer: it fails with
the old bare unwrap (same payload as CI run 39065427720), passes with the
helper, keeps an expired bound at one attempt, and stops on a non-Busy error.

No production changes. The historical lock holder in the CI sample remains
unknown.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test(cli): witness streaming sibling opens after a replaced parent

Drive the real on-disk indexed CLI route with pipe backpressure so the
search is held inside the first sibling while the test replaces their
parent. The former batch loop printed the next sibling through the
replaced parent before failing ancestor verification; the streaming
route resolves it again and prints only the replacement.

Unix-only: Windows pins an open parent against replacement.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* Test operations.cancel on an in-flight managed collection

Add a hooks-gated daemon integration test that pauses a real
collections.start operation at object-withdrawn, object-pending-deletion,
member-intent-saved, member-before-io and collection-before-complete,
services operations.cancel while the worker is parked, and then releases it.

The cancelled receipt must be terminal with no delete credit after the
cancel point, unchanged checkpoint members for pre-IO points, a discarded
verification context, namespace retained memory back at its pre-collection
baseline, and an idempotent replay. Fresh operations then resume from the
saved cursor and finish collection with scan parity.

Removing the cancellation recheck after MemberBeforeIo makes the test fail
with 1475 bytes credited after cancellation at member-intent-saved.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

* test: continue collection barriers past legitimate short passes

A bounded collection pass may complete before an armed member/object
barrier: an escaped reader of the object skips it without error, or the
pass exhausts its elapsed budget and returns a resumable cursor. Windows CI
run 39092617708 hit this in the member-before-io iteration of
collection_crash_boundaries_preserve_live_views_and_resumable_progress
(hook armed with 0 hits, one completed pass, 0 errors, 0 verification
pages). The log cannot distinguish the two causes.

Fault tests now start continuation passes with fresh tokens only after a
classifier accepts the short pass (completed, uncancelled, errorless, no
omitted details, target detail limited to object-readers-active, or an
exceeded budget with a cursor). Pass completion is observed through the
in-memory maintenance counters so the poller never reads the catalog
while a pass may hold it at the credit barrier. Recovery assertions keep
their committed expectations, accepting an interrupted, uncommitted
continuation only at removal barriers after earlier passes deleted every
member. Adds a classifier unit test and a witness that drives both
legitimate paths deterministically. No production or budget changes.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13

---------

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: cff18193-91c7-4186-9e2d-7dfa8433e29d
Copilot-Session: d2a0130e-af45-49cc-ac06-2c1da73d9d13
Copilot-Session: 23051c7b-9d3c-4f54-9d4e-72897ee5a82a
Copilot-Session: 417710f4-d898-45a9-ade1-dd8f33592373