fix(cli,build): stop the option pre-scan at --; cap BMI stamp masking at two

—— 自我复审抓到的两处

`--jobs` 走的是 `--offline` 那条 env 侧信道,而那个预扫描会一路扫完整个 argv,
于是 `mcpp run -- -j 4` 里属于**被运行程序**的 `-j` 被 mcpp 当成了自己的并发设置。
`-j` 是个足够常见的 flag,这是「什么时候撞上」而不是「会不会撞上」的问题。
预扫描遇到裸 `--` 即停;`--quiet`/`--offline` 同样受益(它们本来也不该越过分隔符)。

`bmi_equivalent` 只掩蔽长得像时间戳的字节,但没限制**数量** —— 用户代码里一个
形如 `"buildtime: 2020/01/01 00:00:00 UTC"` 的字符串常量也会被掩掉,
于是改动它不会传播给导入者。实测真实 BMI 从 10 KiB 到 645 KiB 都**恰好 2 处**
(一个 buildtime + 一个 localtime),超过就说明来源不是 GCC 的头部,退回严格比较。

测试:新增 e2e 231(`--jobs N|auto` 生效、坏值必须**告警而非静默降级**、
`--` 之后的参数必须原样送达程序且 mcpp 不得解读),
单测新增 `MoreStampsThanGccEmitsFallsBackToStrictCompare`(两侧都钉:
两处必须掩、三处必须不掩 —— 只钉一侧的话「什么都不掩」的实现也能通过)。
本地:e2e 230/231 通过,test_bmi_equivalent 9/9 通过。

Author: speak-agent

src/build/stage.cppm

@@ -225,6 +225,13 @@ bool looks_like_stamp(std::string_view v) {
         && digit(17) && digit(18) && v.substr(19) == " UTC";
 }
 
+// GCC writes exactly one `buildtime:` and one `localtime:` into a BMI header —
+// verified across BMIs from 10 KiB to 645 KiB, always 2. Anything beyond that
+// came from somewhere else (a string literal in user code that happens to look
+// like a stamp), and masking it would hide a REAL difference. Finding more than
+// this many makes the comparison fall back to strict equality.
+constexpr std::size_t kMaxStampSpans = 2;
+
 // Byte spans to ignore, in ascending order. Only spans whose payload actually
 // looks like a timestamp are masked — a prefix that happens to appear in some
 // other position is left to compare strictly.
@@ -265,7 +272,7 @@ bool bmi_equivalent(const std::filesystem::path& a, const std::filesystem::path&
     // Disagreement about WHERE the stamps are is itself a structural
     // difference; fall back to strict equality rather than guessing.
     if (sa != sb) return *da == *db;
-    if (sa.empty()) return *da == *db;
+    if (sa.empty() || sa.size() > kMaxStampSpans) return *da == *db;
 
     std::size_t cursor = 0;
     for (const auto& [start, end] : sa) {

src/cli.cppm

@@ -106,6 +106,11 @@ int run(int argc, char** argv) {
     // the App below so they show up in --help and pass schema checks.
     for (int i = 1; i < argc; ++i) {
         std::string_view a = argv[i];
+        // Everything after a bare `--` belongs to the program being run or the
+        // test binary being invoked, not to mcpp. Without this, `mcpp run -- -j 4`
+        // reads the child's flag as mcpp's own concurrency setting — `-j` is a
+        // common enough flag that this is a matter of when, not whether.
+        if (a == "--") break;
         if      (a == "--quiet" || a == "-q") mcpp::ui::set_quiet(true);
         else if (a == "--no-color")           mcpp::ui::disable_color();
         else if (a == "--verbose" || a == "-v") mcpp::log::set_verbose(true);

tests/e2e/231_jobs_option.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# `--jobs N|auto` and the `--` boundary that keeps it from eating a program's flags.
+#
+# Two separate contracts, both easy to break without noticing:
+#   1. the option is honoured and a bad value is REPORTED, not silently dropped
+#      (a typo that quietly restores the default is a build mysteriously slower
+#      than the user asked for);
+#   2. `-j` is a common enough flag on other programs that `mcpp run -- -j 4`
+#      must reach the child untouched. `--jobs` reaches its consumer through the
+#      MCPP_JOBS side channel, and that pre-scan used to walk the whole argv.
+set -e
+
+TMP=$(mktemp -d)
+trap "rm -rf $TMP" EXIT
+cd "$TMP"
+
+cat > mcpp.toml <<'EOF'
+[package]
+name    = "jobsopt"
+version = "0.1.0"
+
+[toolchain]
+default = "gcc@16.1.0"
+macos   = "llvm@22.1.8"
+windows = "llvm@20.1.7"
+EOF
+mkdir -p src
+cat > src/main.cpp <<'EOF'
+#include <cstdio>
+int main(int argc, char** argv) {
+    for (int i = 1; i < argc; ++i) std::printf("%s\n", argv[i]);
+}
+EOF
+
+# 1. A numeric value builds.
+"$MCPP" build --release --jobs 2 > "$TMP/j2.txt" 2>&1 \
+  || { echo "--jobs 2 failed:"; cat "$TMP/j2.txt"; exit 1; }
+
+# 2. `auto` builds too. Its value depends on the host, so the assertion is that
+#    it is ACCEPTED — asserting a particular number would encode this machine.
+"$MCPP" build --release --jobs auto > "$TMP/jauto.txt" 2>&1 \
+  || { echo "--jobs auto failed:"; cat "$TMP/jauto.txt"; exit 1; }
+if grep -qi 'invalid job count' "$TMP/jauto.txt"; then
+    echo "'auto' was rejected as an invalid job count:"; cat "$TMP/jauto.txt"; exit 1
+fi
+
+# 3. A bad value must WARN and still build (degrading to the backend default).
+#    Asserted from both sides: a silent drop and a hard failure are both wrong.
+"$MCPP" build --release --jobs bogus > "$TMP/jbad.txt" 2>&1 \
+  || { echo "a bad --jobs value should warn, not fail the build:"; cat "$TMP/jbad.txt"; exit 1; }
+grep -qi 'invalid job count' "$TMP/jbad.txt" \
+  || { echo "a bad --jobs value was accepted silently:"; cat "$TMP/jbad.txt"; exit 1; }
+
+# 4. THE BOUNDARY. Everything after `--` belongs to the program.
+"$MCPP" run -- -j bogus > "$TMP/sep.txt" 2>&1 \
+  || { echo "run with trailing program args failed:"; cat "$TMP/sep.txt"; exit 1; }
+grep -qx -- '-j'    "$TMP/sep.txt" || { echo "'-j' did not reach the program:";    cat "$TMP/sep.txt"; exit 1; }
+grep -qx -- 'bogus' "$TMP/sep.txt" || { echo "'bogus' did not reach the program:"; cat "$TMP/sep.txt"; exit 1; }
+# ...and mcpp must not have interpreted it as its own concurrency setting.
+if grep -qi 'invalid job count' "$TMP/sep.txt"; then
+    echo "mcpp consumed a flag that belonged to the program:"; cat "$TMP/sep.txt"; exit 1
+fi
+
+echo "jobs option OK"

tests/unit/test_bmi_equivalent.cpp

@@ -105,3 +105,29 @@ TEST(BmiEquivalent, MissingFileIsNotEquivalent) {
     auto a = write(d / "e1.gcm", bmi_like("2026/08/12 02:25:01 UTC"));
     EXPECT_FALSE(mcpp::build::stage::bmi_equivalent(a, d / "does-not-exist.gcm"));
 }
+
+// A real BMI carries exactly two stamps — one `buildtime:`, one `localtime:` —
+// checked across BMIs from 10 KiB to 645 KiB. A third one did not come from
+// GCC's header, so it is not mcpp's to ignore: masking a timestamp-shaped
+// string literal in user code would hide a change the importers must see.
+//
+// Asserted from BOTH sides. Checking only that the extra span is not masked
+// would also pass an implementation that masks nothing at all, which is the
+// bug this whole function exists to fix.
+TEST(BmiEquivalent, MoreStampsThanGccEmitsFallsBackToStrictCompare) {
+    const auto d = tmpdir();
+    // Two stamps: masked, so the differing clock does not count.
+    auto two_a = write(d / "t1.gcm", bmi_like("2026/08/12 02:25:01 UTC"));
+    auto two_b = write(d / "t2.gcm", bmi_like("2026/08/12 02:25:09 UTC"));
+    EXPECT_TRUE(mcpp::build::stage::bmi_equivalent(two_a, two_b));
+
+    // The same two, plus a third stamp-shaped string in the payload that
+    // differs. It must NOT be masked, so the two files are different.
+    auto three_a = write(d / "u1.gcm",
+                         bmi_like("2026/08/12 02:25:01 UTC",
+                                  "buildtime: 2020/01/01 00:00:00 UTC"));
+    auto three_b = write(d / "u2.gcm",
+                         bmi_like("2026/08/12 02:25:09 UTC",
+                                  "buildtime: 2020/01/02 00:00:00 UTC"));
+    EXPECT_FALSE(mcpp::build::stage::bmi_equivalent(three_a, three_b));
+}