Commit Graph
4150 Commits
Author SHA1 Message Date
morluto d830cb79b3 fix(analysis): resolve procedure identities and preserve literal queries 2026-10-09 02:42:39 +08:00
morluto f2e22e13a6 fix(hopper): preserve native navigation and annotation semantics 2026-10-09 02:42:39 +08:00
Ysopwnable b743bd20a0 fix(hopper): verify lease cleanup and repair the macOS test lane (#1111)
* fix(hopper): distinguish shared lease roots from leaked sessions

* fix(ci): follow the moved process CLI regression tests
2026-10-09 02:41:34 +08:00
Ysopwnable ec6db0f063 perf(javascript): reuse validated immutable graphs (#1112)
* perf(javascript): reuse validated immutable graphs

* fix(ci): follow the moved process CLI boundary test
2026-10-09 02:40:21 +08:00
morluto 1f5be750bc fix(ghidra): harden location resolution and provider lifecycle
Preserve boundary diagnostics, resolve procedure names before bare hex addresses, and launch the inspected JVM directly on macOS for verifiable startup cancellation. Keep private socket paths within host limits and retain ownership when cleanup is incomplete.

Exercise the fixes through real CLI/MCP Ghidra workflows and provider-boundary integration tests, replacing redundant unit coverage.
2026-10-09 02:38:07 +08:00
morluto e2fc2493b6 fix(process): retain ownership after incomplete cleanup 2026-10-09 02:37:47 +08:00
morluto be783efaba fix(release): always bump minor for releases 2026-10-09 02:15:30 +08:00
morluto 7005166f58 test(hopper): verify real boundaries and prune redundant happy paths 2026-10-09 02:05:58 +08:00
morluto 2f71375efc fix(hopper)!: bind analysis to the active target and correct boundary contracts
Preserve native document identity, nullable bookmark labels, address diagnostics, segment-end byte prefixes, and verified file mappings. Validate batch rename addresses before mutation.

BREAKING CHANGE: remove set_current_document. Use open_binary to switch targets; document arguments are scoped to the active target.
2026-10-09 02:05:31 +08:00
Ysopwnable 34cc9259c1 fix(process): derive executable names from the capture host (#1108) 2026-10-09 02:02:24 +08:00
Rudy Mizrahi Celekli 8b08ec0af9 fix(browser): compose nested source-map column offsets (#1109)
* test(browser): verify native nested source-map coordinates

Qualify valid compiler-produced nested index maps through actual owned Chrome and the built public analyze-web-bundle CLI. Preserve same-line and zero-column controls, physical UTF-16 mapping positions and the independently correct dedicated decoder control. No production or workflow changes.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* test(browser): retain native source-map failure receipts

Serialize the already-created phase and proof fields for failed native source-map owners. Preserve all producer inputs, scenarios, commands and assertions; first native two-failure/two-control evidence remains unchanged.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* test(browser): preserve nested source-map boundary contracts

Qualify ordinary maps, nested offsets, sibling clipping, parent gaps, empty sections and deeper composition against the actual browser fetcher. Compare the existing dedicated decoder only for its valid non-overlapping profile. Preserve the four frozen compiler/Chrome/public CLI scenarios.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(browser): compose nested source-map column offsets

Normalize indexed sections to absolute leaf offsets before upstream flattening. Apply enclosing column offsets only for same-line child sections and retain parent clipping boundaries for gaps and empty sections. Preserve raw map evidence, source identities, transport budgets and the dedicated decoder profile.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-09 02:01:29 +08:00
morluto 82560ebf59 test(process): serialize real CLI capture boundaries 2026-10-09 01:55:12 +08:00
morluto 8a4c4b657f test(process): report the cause of terminal capture failures 2026-10-09 01:55:12 +08:00
morluto 1d0baa352f fix(native): preserve bridge failure types during cleanup 2026-10-09 01:55:12 +08:00
morluto 7c323870c2 fix(native): bound retained observations and preserve failure evidence 2026-10-09 01:55:12 +08:00
morluto d6cc9ca3a6 fix(javascript): preserve lexical open and exact template semantics 2026-10-09 01:55:12 +08:00
morluto fe297e56e8 fix(apple): classify empty dyld settings by consumer semantics (#1110) 2026-10-09 01:54:32 +08:00
Ysopwnable 1e63144390 ci: run signature target binding regressions on native macOS (#1107) 2026-10-09 01:53:40 +08:00
Ysopwnable cd756b07d5 fix(hopper): report launcher failures before bridge timeout (#1105)
* fix(hopper): report launcher failures before bridge timeout

* fix(hopper): separate helper ownership from GUI lifetime
2026-10-09 01:51:45 +08:00
morluto 7914e36ab9 fix(apple): validate dylib candidates and preserve search uncertainty (#1100)
* fix(apple): validate dylib candidates and preserve search uncertainty

* fix(apple): scope embedded dyld uncertainty by search phase

* fix(apple): scope dyld prefixes to eligible paths and platforms

* fix(apple): ignore embedded process settings on library roots
2026-10-09 01:43:52 +08:00
Rudy Mizrahi Celekli 3b2ec69c54 fix(apple): report missing keyed archive hierarchy references (#1104)
* test(apple): qualify malformed native hierarchy references

Freeze actual Foundation/AppKit producer, single-slot positive UID mutation and real optional nil control at filesystem and compiled CLI boundaries. Preserve original raw-byte evidence and existing CI.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(apple): report missing keyed archive hierarchy references

Preserve known hierarchy objects and links while reporting unresolved nonnil object-table references as partial coverage. Retain archived nil semantics and original byte evidence.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-09 01:31:53 +08:00
Ysopwnable 4bb056bbb5 fix(artifacts): retain failed DMG cleanup state and diagnostics (#1103) 2026-10-09 01:28:42 +08:00
morluto c789af04b7 fix(native): bind signature observations to registered target versions (#1099)
* fix(native): bind signature observations to registered target versions

* fix(native): preserve target drift and cancellation across signature captures

* fix(native): inspect signatures from a verified byte snapshot
2026-10-09 01:27:26 +08:00
morluto acb3e0f2e5 fix(release): restore automatic release proposals on main 2026-10-09 01:25:36 +08:00
Rudy Mizrahi Celekli 3db46813f8 fix(javascript): parse plain TypeScript artifact dialects (#1102)
* test(javascript): reproduce TypeScript source dialect loss

Add native directory/ASAR and built public CLI owners with actual locked native TypeScript syntax/emit and independent Babel source-range oracles. Production and every workflow remain unchanged.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* test(javascript): admit isolated native compiler inputs

Use the actual TypeScript7 producer-requested --ignoreConfig flag when supplying isolated source filenames. Preserve every graph input, owning assertion, control and production file.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(javascript): parse plain TypeScript artifacts without JSX

Select the plain .ts dialect using the artifact source path so valid angle-bracket assertions retain syntax-derived graph facts. Preserve existing JSX defaults and all other dialects. Document the inert artifact parser contract.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
2026-10-09 01:24:47 +08:00
Ysopwnable cc0ee2edc6 fix(javascript): honor cancellation before evidence publication (#1098) 2026-10-09 01:15:50 +08:00
Rudy Mizrahi CelekliandN0zoM1z0 f8e143a3bc fix(apple): decode Interface Builder XML byte encodings (#1095)
* test(apple): qualify native Interface Builder XML encodings

Exercise actual AppKit/Foundation XML archive representations through filesystem and compiled CLI consumers. Preserve independent UID/hierarchy and original-byte provenance oracles.

Tests-only candidate qualification on unchanged native Apple CI; no production or workflow changes.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(apple): share BOM-aware Interface Builder XML decoding

Reuse the existing fatal BOM-aware XML plist decoder for Interface Builder archives. Preserve original serialized-byte digests, binary decoding, and frozen native producer/consumer tests.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(apple): reject unsupported XML encoding declarations

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-09 01:11:49 +08:00
Kaoru0822 ae0630a619 Merge pull request #1097 from morluto/fix/web-runtime-script-initiators
fix(browser): treat module-import initiator positions as script positions
2026-10-08 10:00:21 -07:00
Ysopwnable 81b5104276 fix(analysis): bind overview document identity to the active target (#1094)
* fix(analysis): bind overview document identity to the active target

* fix(analysis): refresh legacy overview snapshot results
2026-10-09 00:57:28 +08:00
morluto 4a1837d9d5 fix(javascript): bound primitive string growth and repeated evaluation 2026-10-09 00:49:31 +08:00
morluto 770d2f60aa test(workflows): verify residual questions in CLI snapshots 2026-10-09 00:49:31 +08:00
morluto eb89a16d9b fix(process): identify unknown live processes in cleanup diagnostics 2026-10-09 00:49:31 +08:00
morluto bfb7776006 fix(release): publish prereleases under the next npm tag 2026-10-09 00:49:30 +08:00
morluto 4b1066501b refactor(setup): validate formats through canonical configuration 2026-10-09 00:49:30 +08:00
morluto 8b01e0cc89 fix(providers): validate ELF versions and preserve probe cancellation 2026-10-09 00:49:30 +08:00
morluto 915855e75c fix(native): supervise LLDB and preserve bounded capture uncertainty 2026-10-09 00:49:30 +08:00
morluto 488f448ae2 fix(apple): derive dispatch coverage from located decode facts 2026-10-09 00:49:30 +08:00
morluto 15f92f2988 fix(apple): validate physical slices and dylib platform compatibility 2026-10-09 00:49:30 +08:00
morluto 16f4609d68 fix(javascript): bound semantic expansion and resolve lexical receivers 2026-10-09 00:49:30 +08:00
morluto eaf5734083 fix(browser): bound source-map fetches and retain predecessor requests 2026-10-09 00:49:30 +08:00
morluto 135d102f9d refactor(artifacts): centralize stable inventory identities 2026-10-09 00:49:30 +08:00
morluto d4c2c3c18f fix(target): preserve app bundle filesystem failure reasons 2026-10-09 00:49:30 +08:00
morluto 17809caacd fix(managed): match exact method bytes without decoded signatures 2026-10-09 00:49:30 +08:00
morluto 0136ee8c22 fix(workflows): retain residual unknowns through CLI and MCP 2026-10-09 00:49:30 +08:00
morluto 65a6288257 refactor(input): share schema issue error construction 2026-10-09 00:49:30 +08:00
Kaoru0822andClaude Opus 5.5 99d31ee24a fix(browser): treat module-import initiator positions as script positions
An empty script_id also marks a script-type initiator, such as a module
import, whose url is the importing script file. Its position is a real
script position without a session-script association. The previous
wording called every empty-ID callsite parser markup with "no script
position" and excluded it from the external-script conversion. Describe
the empty ID as a missing session-script association, which only rules
out joining captured source or resource_start, and keep the
external-script conversion for script-file positions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 16:44:25 +00:00
Kaoru0822andClaude Opus 5.5 3c157b4ec6 fix(browser): keep initiator callsites out of script coordinate guidance (#1096)
observe_web_execution also derives callsites from a request's reported
initiator, such as an image the parser found in HTML or a module import,
with an empty script_id. Those positions point into the initiating
resource, not a script, so the "script's enclosing resource" wording and
source-map conversion did not apply to them. Describe the coordinates as
relative to the resource named by url, explain empty script IDs, and
limit the documented conversion to positions with a script_id.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 00:43:03 +08:00
Rudy Mizrahi CelekliandN0zoM1z0 c1b370ce0d fix(javascript): retain NodeNext artifact source facts (#1087)
* test(javascript): reproduce omitted NodeNext artifact sources

Tests only: qualify current .mts/.cts artifact selection through real directory and ASAR reconstruction and the built public CLI.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

* fix(javascript): retain NodeNext artifact source facts

Read .mts and .cts artifact files through the existing inert TypeScript parser, preserving selected file identities and analysis facts in directory and ASAR inputs. Document source selection and format the existing regression assertion.

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>

---------

Signed-off-by: Rudy Celekli <rudy@gradiahq.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-09 00:39:39 +08:00
Alan VoandN0zoM1z0 5a67c7fc54 fix(hopper): diagnose MCP provider failures with stage, state, and request context (#1044)
* fix(hopper): diagnose MCP provider failures with stage, state, and request context

* fix(hopper): retain health at the actual provider lifecycle boundary

* test(hopper): distinguish socket loss from later observed process exit

* test(hopper): cover observed exit separately from socket-first replies

---------

Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-09 00:33:56 +08:00
b5c2954ad6 fix(domain): order canonical paths by code point, not UTF-16 unit (#1034)
compareCodePoints documented a Unicode code-point comparison but used
</> operators, which compare UTF-16 code units. For astral code points
(above U+FFFF) the lead surrogate 0xD800-0xDBFF is numerically below the
BMP tail U+E000-U+FFFF, so those characters sorted before it.

Delegate to the existing compareUnicodeCodePoints, which the domain
already uses elsewhere, so the two canonical comparators agree. All call
sites use only the sign, so sort and '< 0' checks are unaffected.

Adds the missing regression coverage for canonicalOrdering.

Co-authored-by: TahsinArafat <TahsinArafat@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-09 00:26:25 +08:00