fix(scanner): prune .mcpp from glob walks; never throw on unnarrowable names (#230)

Root cause of the windows-latest 'exit 127' (really 0xC0000409): 0.0.95's
scanner walks globs with follow_directory_symlink, and the project-local
`.mcpp/.xlings/data/<index>` entry is a symlink back to the index root —
so the walk escapes into the entire index checkout. In mcpp-index CI that
tree contains a vendored xim-pkgindex whose issue template has a CJK
filename; path_matches_glob spelled it narrow via generic_string(), which
on MSVC under a non-CJK ANSI codepage throws std::system_error. The
exception escaped main uncaught -> std::terminate -> __fastfail
(0xC0000409), which git-bash reports as a bare exit 127.

Three layers, all fixed:
- expand_glob/expand_dir_glob prune directories named .mcpp — mcpp's own
  metadata dir is never a source dir, and pruning it severs the symlink
  escape at its origin (also stops walking the whole index per member).
- path_matches_glob treats a name with no narrow spelling as 'no match'
  instead of letting the conversion tear down the build.
- main() gains a last-resort catch: an escaped exception now names itself
  and exits 70 instead of a silent fastfail.

Evidence: full-memory WER dump from the CI runner shows the throw chain
scan_one_into -> expand_glob -> path_matches_glob -> _Convert_wide_to_narrow
with the wide string
'.mcpp\.xlings\data\compat\mcpp-0.0.95-windows-x86_64\registry\data\
xim-pkgindex\.github\ISSUE_TEMPLATE\bug-report---<CJK>.md'.
Behavioral control on linux: release 0.0.95 compiles an out-of-tree
extra.cpp through the .mcpp symlink (duplicate main at link); the fixed
binary prunes it and builds clean. e2e 113 encodes both assertions.
35/35 unit tests pass.

Author: speak-agent

src/main.cpp

@@ -5,7 +5,20 @@ import std;
 import mcpp.cli;
 
 int main(int argc, char* argv[]) {
-    int rc = mcpp::cli::run(argc, argv);
+    int rc;
+    try {
+        rc = mcpp::cli::run(argc, argv);
+    } catch (const std::exception& e) {
+        // Last-resort boundary: without it an escaped exception is
+        // std::terminate — on Windows a silent 0xC0000409 that git-bash
+        // reports as a bare exit 127 (mcpp#230 wore that mask). Name the
+        // real error and exit with a recognizable internal-error code.
+        std::println(std::cerr, "error: internal: unhandled exception: {}", e.what());
+        rc = 70;   // EX_SOFTWARE
+    } catch (...) {
+        std::println(std::cerr, "error: internal: unhandled non-standard exception");
+        rc = 70;
+    }
 #ifdef __APPLE__
     // With statically linked libc++ (the macOS release linkage since
     // 0.0.50), static destruction can SIGABRT on exit — same issue xlings

src/modgraph/scanner.cppm

@@ -110,7 +110,18 @@ bool path_matches_glob(const std::filesystem::path& candidate,
     // through a directory symlink back to its real location and break the
     // match (globs are about where a file appears in the tree, not where
     // its bits live).
-    auto rel = candidate.lexically_relative(root).generic_string();
+    std::string rel;
+    try {
+        rel = candidate.lexically_relative(root).generic_string();
+    } catch (const std::exception&) {
+        // MSVC's narrow conversion throws std::system_error when the
+        // native (wide) name has no spelling in the ANSI codepage (e.g. a
+        // CJK filename on an en-US host — mcpp#230 hit this on an issue
+        // template inside a walked index tree). Such a name can never be
+        // spelled in a glob or a compile command either: not a match, and
+        // never a reason to tear down the whole build.
+        return false;
+    }
 
     auto match = [](std::string_view s, std::string_view p) -> bool {
         // Simple recursive matcher.
@@ -242,6 +253,15 @@ std::vector<std::filesystem::path> expand_glob(const std::filesystem::path& root
     for (fs::recursive_directory_iterator end; !ec && it != end; it.increment(ec)) {
         auto& e = *it;
         if (e.is_directory(eec) && !eec) {
+            // `.mcpp` is mcpp's own project metadata dir. Its xlings data
+            // tree holds a SYMLINK back to each path-dep index root, so
+            // following it walks that entire checkout (mcpp#230: the CI
+            // workspace walked into a vendored xim-pkgindex and died on a
+            // CJK filename). Never a source dir — prune by name.
+            if (e.path().filename() == ".mcpp") {
+                it.disable_recursion_pending();
+                continue;
+            }
             auto depth = static_cast<std::size_t>(it.depth());
             chain.resize(std::min(chain.size(), depth + 1));
             auto c = fs::canonical(e.path(), eec);
@@ -294,6 +314,11 @@ std::vector<std::filesystem::path> expand_dir_glob(const std::filesystem::path&
          !ec && it != end; it.increment(ec)) {
         auto& e = *it;
         if (!e.is_directory(eec) || eec) continue;
+        // Same `.mcpp` prune as expand_glob (see comment there / mcpp#230).
+        if (e.path().filename() == ".mcpp") {
+            it.disable_recursion_pending();
+            continue;
+        }
         auto depth = static_cast<std::size_t>(it.depth());
         chain.resize(std::min(chain.size(), depth + 1));
         auto c = std::filesystem::canonical(e.path(), eec);

tests/e2e/113_scanner_mcpp_dir_prune.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# requires: gcc
+# mcpp#230: the source scanner follows directory symlinks (0.0.95), and the
+# project-local `.mcpp/.xlings/data/<index>` entry is a SYMLINK back to the
+# index root — following it walks that entire checkout. In CI that tree held
+# a CJK-named file, whose wide→narrow spelling throws on MSVC (bare
+# 0xC0000409 / exit 127). Assert both fixes:
+#   1. `.mcpp` is pruned from glob walks — an out-of-tree file reachable only
+#      through the symlink must NOT be compiled (it double-defines main).
+#   2. A file whose name cannot be narrowed never aborts the build (covered
+#      on MSVC by path_matches_glob's catch; here it just rides along).
+set -e
+
+TMP=$(mktemp -d)
+trap "rm -rf $TMP" EXIT
+
+cd "$TMP"
+mkdir -p outside/sub proj/src
+
+cat > outside/sub/extra.cpp <<'EOF'
+int main() { return 9; }   // double-defines main if the walk escapes
+EOF
+# CJK filename — on MSVC hosts with a non-CJK ANSI codepage this name has no
+# narrow spelling; the scanner must skip it, not tear down the build.
+cat > "outside/sub/问题反馈.cpp" <<'EOF'
+int cjk_never_compiled() { return 2; }
+EOF
+
+cat > proj/src/main.cpp <<'EOF'
+int main() { return 0; }
+EOF
+cat > proj/mcpp.toml <<'EOF'
+[package]
+name = "prunetest"
+version = "0.1.0"
+
+[build]
+sources = ["**/*.cpp"]
+EOF
+
+# Simulate the path-dep index link mcpp creates under the project data dir.
+mkdir -p proj/.mcpp/.xlings/data
+ln -s "$TMP/outside" proj/.mcpp/.xlings/data/compat
+
+cd proj
+"$MCPP" build
+"$MCPP" run
+
+echo "PASS: .mcpp symlink escape pruned; build unaffected by unmatchable names"