Commit graph

3 commits

Author SHA1 Message Date
trvon
cb600dbac9
feat: IR language discriminator + Clang node kinds (Phase 3, multi-language IR)
- Language enum: Unknown, Rust, Cpp, Swift on RustExprNode
- 4 new Clang node kinds: ThrowExpr, CXXConstructExpr, LambdaExpr, StmtExpr
- Updated json_keys namespace with new constants
- 42 roundtrip test assertions pass
- All 3 frontends now share the same IR representation
2026-05-28 20:55:54 -04:00
trvon
ffc7917957
feat: symbolic IR, swift backend, binary-to-fuzz pipeline, SARIF fixes
- Rust IR encoder (encodeRustIr): walks HIR expr trees, fires SafetyObserver hooks
- Swift SIL frontend (fold-swift): swiftc -emit-sil parser, demangling, NDJSON output
- SwiftBackend: --mode swift CLI routing, shells out to fold-swift
- Binary-to-fuzz: Mach-O export discovery, ARM64 ABI param-count inference, dlopen harness generation
- Language-agnostic IR: json_keys canonical constants, Call/Member/ArraySubscript/Cast/HeapNew nodes
- Dogfood fixes: SARIF kind field, cross-detector dedup, harness_file in predictions, Swift stoi safety
- Corpuses: swift-sil-z3-corpus.md, binary-fuzz-corpus.md
- AGENTS.md: cross-language wire format rule
2026-05-27 15:29:14 -04:00
trvon
da4c848cbc
feat(rust): MVP Rust frontend — unsafe-deref detection + clone clustering
First non-clang frontend for fold. Scans Rust source for the
subset of issues that meaningfully exist there: raw-pointer
dereferences in `unsafe` blocks (Heuristic confidence) and
within-Rust Type-1/2/3 clones via the existing clone detector.
Reuses the M30 frontend-agnostic IR + AnalysisBackend
abstraction unchanged.

Architecture: a separate `tools/fold-rust` cargo binary that the
C++ `RustBackend` shells out to. Two subprocess invocation
modes:

- `extract --unit <file>`: standalone .rs file, no Cargo
  context (limited; external-crate imports won't resolve).
- `cargo-check --crate-dir <dir>`: invokes `cargo check` with
  RUSTC_WORKSPACE_WRAPPER set to ourselves so cargo supplies
  the full --extern/-L/--cfg per-TU. Mirrors the
  clippy/miri/kani pattern.

RustBackend::discoverUnits walks up from each `.rs` input to
find the nearest Cargo.toml and collapses sibling files to one
crate unit; orphan files fall back to single-file extract.
scan_router auto-detects --mode=rust when all paths are `.rs`;
mixed Rust + C/C++ warns and defaults to source mode.

Includes:

- tools/fold-rust/: cargo crate pinned to nightly-2026-05-22.
  HIR-driven DerefHunter (raw-pointer dereference detection
  via typeck `is_raw_ptr()`) and HashWalker (FNV-1a + mix64
  port of src/ir/normalize.cpp for FunctionSummary hashes).
- include/fold/ir/expr_json.{hpp,cpp}: RustExprNode +
  RustNodeArena + bidirectional JSON wire format for
  ir::Expr; round-trip tested across 8 Kinds.
- include/fold/frontend/rust_backend.{hpp,cpp}: AnalysisBackend
  impl. posix_spawnp + NDJSON parser. Caches summaries +
  findings across extractFunctions calls; polymorphic
  runDetectorsOnShard dispatch routes summaries to
  detectClones.
- src/cli/{main,scan_router,scan_runner}.cpp: --mode=rust
  branch + autoDetectRust(). Mode validation extended to
  accept rust.
- docs/rust-frontend.md: scope, wire format, rustc-private
  pin + bump procedure, verification snippets.

44/44 unit + integration tests still green. Verified
end-to-end on a 3-function rename-pair fixture: 1 clone
cluster + 1 raw-deref finding through both `extract` and
`cargo-check` paths.

Out of scope (tracked separately): equiv + class-dup
detectors (need encoder frontend-agnostification),
dead-statement (needs Rust CFG), cross-language clones
(needs unified kind-tag taxonomy), Proved/ConcreteWitness
promotion (needs encoder integration), `cargo fuzz`
harnesses.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-22 22:36:28 -04:00