Repository navigation
Feat/incremental scan CWE ignore - #27
Merged
Merged
Conversation
Features - Incremental workspace scan: unchanged files reuse their cached SARIF and stack results, persisted across sessions. The cache is invalidated by header, compile_commands.json, binary or option changes (ctrace.workspace.incremental). - CWE links: diagnostic codes link to cwe.mitre.org, diagnostics name the analyzer and list "also reported by"; CWE badges in the sidebar. - Ignore findings: quick fix, sidebar button and commands backed by a committable .coretrace-ignore.json; fingerprints survive line shifts. Fixes - Cancellation/timeout now kills ctrace and its analyzers (process group), not only the wrapping shell. - Quote file paths in the native shell command (command injection through file names such as `a$(cmd).c`). - Workspace scans no longer overwrite diagnostics reported into a shared header by several files. - Locate compile_commands.json without hashing every workspace file. - Declare the ctrace.* settings in package.json; add ctrace.analysis.timeoutSeconds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
normaliseMountPath converts backslashes to forward slashes, so a file could be keyed as both C:/x/a.c and C:\x\a.c, and its diagnostics could overwrite each other. This also made the quick-fix finding lookup test fail on Windows.
The SVG graph needed constant zooming and panning in a 300px sidebar, and the card list below it repeated the same data. - Expandable call tree, heaviest callees first, with a data bar behind each value and the heaviest call path highlighted. - Ranking view, a single filter by function or file, and a details card with clickable callers and callees. - Keyboard navigation. Recursive calls end on a marked row, and very dense graphs are truncated instead of freezing the sidebar. - CodeLens now finds qualified functions from unqualified names. - Bars use the CSSOM, since the webview CSP blocks inline style attributes.
- Search across all settings; a match inside a switched-off group leads to its switch. - Counters on the gear and on each section, and a bar on each changed row, so a forgotten filter cannot silently narrow the results. - Clearer labels with short descriptions, switches instead of checkboxes, and a single line explaining options the current scan mode cannot use. - SMT fields only appear when the solver is on. - Actions for analyzers, VS Code settings and CLI help; reset in two clicks. Fixes - Save the state after restoring it: it was saved before the values were restored, so two reloads could lose the settings. - Save the compile_commands.json path chosen with the file picker. - Remove inline styles blocked by the webview CSP from the install button.
Fixes - Resolve relative "only" and "exclude" directories from the workspace: ctrace does not run from it, so only_dirs hid every function and exclude_dirs excluded nothing. - Send --analysis-profile, which was commented out, so Fast/Full now reaches ctrace. - Mark only the functions that are recursive or over the stack limit in plaintext stack reports, and pass the stack limit to the stack pass. - Restore the compile_commands.json path after a reload. - Convert Windows drive paths in the generated config for WSL. Tests - Every parameter maps to the expected argument or config key, and sidebar controls, runner and package.json settings stay wired together. - Integration suite running each parameter through a real ctrace, skipped without a binary. Known limits: "Cross-file resource analysis" has no effect because files are analysed one at a time, and "Quiet" has no visible effect on SARIF results.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.