fix(daemon): print the validation detail when the secure endpoint cannot be created

[mlandolfi90]

The MCP-client startup path swallows the reason for a refused endpoint:

cbm_daemon_ipc_endpoint_t *endpoint = cbm_daemon_bootstrap_endpoint_new(NULL);
if (!endpoint) {
    (void)fprintf(stderr, "codebase-memory-mcp: secure daemon endpoint could not be created\n");
    return EXIT_FAILURE;
}

Every refusal inside the ancestor DACL walk — owner mismatch, an untrusted grant, a failed repair — arrives as that one sentence. cbm_daemon_ipc_validation_detail() has already recorded exactly which component failed and why, and the worker path a few hundred lines up already prints it for the identity check. This just does the same at the endpoint site.

Concretely, this turns

codebase-memory-mcp: secure daemon endpoint could not be created

into

codebase-memory-mcp: secure daemon endpoint could not be created - C:\Users\<user>\AppData: DACL entry 0 grants mutation rights 0x000d0152 to untrusted identity (other S-1-15-3-...)

Diagnosing the first form took a purpose-built instrumented binary. The second names the directory, the mask and the SID.

No behaviour change beyond the message; the detail buffer is a static already populated on this path.

🤖 Generated with Claude Code

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[mlandolfi90]

CI note: the only red is security / codeql-gate, which timed out with the analysis still queued after 90 polls (BLOCKED: CodeQL timeout) — no alerts were raised, it was never scheduled. I opened five PRs in quick succession, so this may be queue pressure I caused; apologies if so. Everything else is green.

🤖 Generated with Claude Code