chore: errdefer audit for allocator cleanup on OOM paths

[apotema]

Closes #75

Systematic errdefer audit of script_scanner.zig, main_zig.zig, and root.zig for the alloc-then-hand-off pattern where an OOM in a later step of the same function leaks an earlier allocation.

Leaks found and fixed

src/script_scanner.zig

• scanDir root-file branch (name_copy ~L126) — the dupe'd name backs both filename and rel_path on the entry; leaked if addEntryWithPath's entries.append OOM'd. Added errdefer self.allocator.free(name_copy).
• scanDir state-dir branch (subdir_name / dir_states ~L140-143) — subdir_name (dupe) and dir_states (owned slice from parseDirStates) leaked if either shared_subdirs/shared_states append OOM'd. Reworked to ensureUnusedCapacity before the dupe so the appends are infallible; a transferred flag scopes the errdefers to the pre-handoff window.
• scanPluginDir name_dup (~L178-179) — gemini PR feat(plugins): Controller discovery + ship_from_plugin + two-block scripts #73 finding. name_dup leaked if shared_plugin_names.append OOM'd. Reserve-then-appendAssumeCapacity.
• scanPluginDir file branch (name_copy / rel_path ~L203-205) — gemini findings ~198/~202. name_copy leaked if the rel_path allocPrint OOM'd; both leaked if addEntryWithPath OOM'd. Added errdefer on each.
• scanPluginDir state-dir branch (subdir_name / dir_states ~L214-216) — gemini finding ~213. Same fix as scanDir's state-dir branch.
• scanZigFilesRecursive file branch (name_copy / rel_path ~L299-301) — same alloc-then-handoff leak as the plugin file branch. Added errdefer on each.
• parseDirStates (~L320) — a mid-loop dupe/append OOM leaked every state string duped so far plus the ArrayList buffer. Added an errdefer freeing both.
• getEntriesForState (~L272) — the result ArrayList backing buffer leaked on append OOM. Added errdefer result.deinit.
• Swallowed iterator errors — iter.next(io) catch return in scanDir / scanPluginDir / scanZigFilesRecursive silently truncated the script list on a real I/O error (AccessDenied, SystemResources, …). Now propagated via try; ScanError folds in std.Io.Dir.Iterator.Error.

src/main_zig.zig

• generateMainZigFromTemplate (~L2491, 18 append sites) — each emitted code block was toOwnedSlice'd into block then allocs.append(block)'d; an OOM in that append leaked block (it never made it into the allocs cleanup list). Pre-reserve allocs capacity (ALLOCS_BLOCK_COUNT = 18) and switch all sites to appendAssumeCapacity, closing the window.

src/root.zig

Audited — no genuine leaks. rgba_path_allocs already has a matching errdefer allocator.free(rgba_rel); loaded_manifests already reserves capacity before its appendAssumeCapacity (and documents exactly this rationale). All scanner.* results have matching defer freeNames.

Tests

Added two std.testing.checkAllAllocationFailures-based regression tests in test/script_scanner_tests.zig (MemoryLeaks struct) that drive scanDir and scanPluginDir once per allocation, failing each in turn, and assert no memory leaks on the OOM error path. These fail against the pre-fix code and pass after.

Build / test

zig build and zig build test both green — 18/18 steps succeeded; 411/415 tests passed (4 skipped).

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches allocator/error-handling paths in main_zig.zig and script_scanner.zig; mistakes could surface as crashes (insufficient reserved capacity) or changed behavior by now propagating directory iteration errors instead of silently returning.

Overview
Fixes several OOM-path memory leaks by making ownership hand-offs explicit: adds errdefer cleanup for intermediate allocations, reserves ArrayList capacity up front, and switches to appendAssumeCapacity where capacity is guaranteed.

Script scanning now propagates directory iterator errors (and widens ScanError accordingly) instead of silently truncating results, and adds regression coverage via checkAllAllocationFailures tests for both scanDir and scanPluginDir.

^{Reviewed by Cursor Bugbot for commit 1e7ae56. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

This pull request addresses memory leak vulnerabilities and improves OOM robustness across the codebase, specifically targeting issue #75. Key modifications include the use of ensureUnusedCapacity and appendAssumeCapacity to ensure infallible ownership transfers, the addition of errdefer blocks for proper cleanup during partial allocation failures, and the propagation of directory iteration errors. Feedback was provided regarding a hardcoded capacity constant in src/main_zig.zig, which is considered fragile and could lead to runtime panics if new blocks are added without updating the count.

[gemini-code-assist]

The hardcoded constant ALLOCS_BLOCK_COUNT = 18 is fragile and poses a maintainability risk. If a developer adds a new code block and forgets to increment this value, the program will panic at runtime (in debug/release-safe modes) when appendAssumeCapacity is called. While this approach closes the OOM window, consider using ensureUnusedCapacity(allocator, 1) immediately before each toOwnedSlice and append pair to make the code more robust to future changes.