Commit Graph
4494 Commits
Author SHA1 Message Date
gensokyo-dev 8465514782 fix(ci): preserve incomplete dependency evidence as unavailable 2026-10-23 13:57:48 +00:00
gensokyo-dev 08e8501d7b fix(ci): redact all retained dependency evidence at one boundary 2026-10-23 13:46:09 +00:00
gensokyo-dev 95eb175457 fix(ci): redact authentication in case-insensitive URL schemes 2026-10-23 13:38:56 +00:00
gensokyo-dev 1cd471487b chore: update main for dependency security verification 2026-10-23 13:31:38 +00:00
gensokyo-dev 473bcdd204 fix(ci): bind dependency evidence to original release inputs 2026-10-23 13:28:24 +00:00
morluto bc411c24be test: align boundary fixtures with producer contracts
Model GDB console completion, use real directory reads and cleanup for late-enumeration failures, and distinguish supported PTX pointer qualifiers from unknown declarations. Preserve original assertion and cleanup failures through scoped test finalizers.
2026-10-23 21:22:52 +08:00
gensokyo-dev 48a1312237 feat(ci): require live dependency security evidence for releases 2026-10-23 13:18:47 +00:00
morluto 76b56957e9 refactor(android): own search summaries at the producer boundary
Reuse validated class pages for inline pagination audits while retaining complete provider replies. Move retention into the shared Android workflow and remove the MCP-only service wrapper and application text reparser. Preserve unknown JSON metadata, late cancellation and retention failures.
2026-10-23 21:12:42 +08:00
morluto 3c5c887a2c refactor(json): consolidate representation size accounting
Share bounded UTF-8 and UTF-16 JSON measurements across state serving, write retention and source-map admission. Remove duplicate counters and distinguish retained state estimates from encoded bytes while preserving limits and exact refusal diagnostics.
2026-10-23 20:54:19 +08:00
gensokyo-dev 5d6b8a0ab6 fix(release): isolate npm publication from dependency execution (#6681)
Keep dependency execution in read-only release jobs and validate the original qualified archive with Node built-ins before publication. Refresh registry state on every publisher attempt; retain exact bytes/channel verification, v1 read-only recovery, and installed CLI/MCP checks before MCP publication.

Static/docs checks, artifact/registry/recovery tests and real package/rehearsal verification pass. All four hosted package platforms pass. Portable CI retains the independently reproduced main PTX failure in #6675 and fail-fast missing coverage; use the owner-authorized existing PR-only exception, with limitations documented in the PR. Refs #6480.
2026-10-23 12:27:24 +00:00
raidnouredden-ux 8c4f96ef47 chore(deps): update Vite security patch and dependency inventory (#6416)
Update Vite/PostCSS and refresh the lock-derived inventory while retaining TSRS platform selection and runtime dependency versions.

Source/static checks, installed-platform signatures, full/production audits, real CLI/MCP workflows and all four package platforms pass. Portable CI retains the independently reproduced main PTX fixture failure tracked in #6675; use the owner-authorized existing PR-only baseline exception. Refs #6480.
2026-10-23 11:44:32 +00:00
morluto a7f967cf24 style(desktop): format GameMaker probe coverage 2026-10-23 19:30:13 +08:00
morluto 23e68cbdfb fix(macho): preserve import identity in retained views
Use distinct row contracts for imports and exports, retaining ambiguous names and historical import defaults without adding import-only fields to export pages. Verify the SDK-advertised schemas and both facets through MCP.
2026-10-23 19:29:41 +08:00
morluto aa357d6d91 refactor(macho): separate dyld import and export parsing
Keep mode-specific inputs and parsed row types at their respective parser boundaries.
2026-10-23 19:26:17 +08:00
morluto 22df16186f fix(elf): retain raw export name bytes
Fixes #6647
2026-10-23 19:25:29 +08:00
morluto 5d0d243a45 fix(macho)!: preserve ambiguous chained import names
Keep the exact producer expression and report unknown symbol identity when chained-import text cannot distinguish a binding addend from a literal name suffix.

Fixes #6648

BREAKING CHANGE: inspect_macho import names can be null when identity is ambiguous. Use raw_name for the observed expression and name_status to distinguish it from an exact symbol name.
2026-10-23 19:25:29 +08:00
morluto 1280e7e513 fix(macho): infer legacy Intel simulator platforms
Fixes #6649
2026-10-23 19:25:29 +08:00
morluto 5c7755636d fix(model): preserve optional metadata and tensor alignment
Fixes #6656
Fixes #6637
Fixes #6636
2026-10-23 19:23:08 +08:00
morluto d20c7b09a6 refactor(reference-imports): share exact literal parsing
Route legacy nested import-expression handling through the same exact-literal owner as dynamic imports, removing a duplicate string-only check.

Fixes #6654
2026-10-23 19:20:53 +08:00
morluto 139fd52477 fix(il2cpp): reject duplicate method tokens per image
Reject duplicate MethodDef row identities within one owning image before publishing native addresses or Ghidra seeds, while retaining cross-image reuse and folded code addresses.

Fixes #6610
2026-10-23 19:20:53 +08:00
morluto 72dd48a44c fix(managed): respect native module case semantics
Preserve the observed native format when comparing module identities so ELF case-only differences remain mismatches while unknown platform behavior stays unresolved.

Fixes #6652
2026-10-23 19:20:52 +08:00
morluto 9200adea61 fix(reference-imports): retain exported import-equals dependencies
Route exported external import-equals declarations through the same relationship owner as plain declarations so their required target is not dropped.

Fixes #6655
2026-10-23 19:18:47 +08:00
morluto 16e64d58ff fix(reference-imports): retain exact dynamic import targets
Use the shared exact-literal reader for dynamic imports, preserving expression-free templates and transparent TypeScript wrappers while leaving computed targets unknown.

Fixes #6654
2026-10-23 19:18:47 +08:00
morluto 8f9b2ab948 fix(reference-source): preserve raw POSIX filename identity
Mark directories with non-UTF-8 names unsupported without following replacement-character paths, while retaining readable sibling observations.

Fixes #6653
2026-10-23 19:18:47 +08:00
morluto 42086fdba7 fix(gpu): retain resources across entry pragmas
Fixes #6651
2026-10-23 19:18:47 +08:00
morluto 8695ca8257 fix(gpu): bound embedded section reads
Fixes #6657
2026-10-23 19:18:47 +08:00
morluto b443b5a89b fix(harmony): exclude raw resources from manifests
Classify known resource paths once and keep a raw resource named module.json from changing the package model or appearing as a manifest. Add a filesystem-boundary regression and clarify the documented hint.

Fixes #6638
2026-10-23 19:18:47 +08:00
morluto 79b3f4694d fix(desktop): probe GameMaker data filenames
Select conventional Linux and macOS game data files for the existing bounded FORM/GEN8 probe. Add service-boundary regressions and document the selected names.

Fixes #6659
2026-10-23 19:18:47 +08:00
morluto 0e3e577568 fix(erlang): retain admission cancellation reason
Preserve the caller's AbortSignal reason when BEAM inspection is cancelled before provider admission. Keep the production filesystem boundary and late-completion contracts covered.

Fixes #6658
2026-10-23 19:18:47 +08:00
morluto 5bb01ca9a3 fix(gdb): wait for the outer console command to finish
After a running result, queue a tokenized read-only MI query to establish that GDB has returned to its command loop. Keep collecting through intermediate inferior stops and retain the query reply as protocol Evidence.

Fixes #6660
2026-10-23 19:18:47 +08:00
morluto 86a0428d5f fix(gdb): separate queued work from MI synchronization
Queued console followers have not dispatched MI records. Use active protocol requests when deciding whether the admitted close can verify and detach its inferior.

Fixes #6661
2026-10-23 19:18:47 +08:00
morluto 99a5ffae3b fix(native): consolidate observed address validation 2026-10-23 19:11:38 +08:00
morluto 5a5bcb6b54 test(managed): align source goldens with metadata validation
Fixes #6650
2026-10-23 19:10:32 +08:00
morluto 749ae11b15 fix(managed): share reference instruction semantics
Use the same parsed method/field operand predicate when producing member edges and comparing call and field shapes. Exclude ldtoken and operands without a value from both interpretations.
2026-10-23 19:07:46 +08:00
morluto 007f0d214d test(managed): preserve field-access owner identities 2026-10-23 19:07:46 +08:00
morluto e90782283c fix(adb): delimit permission section by indentation 2026-10-23 19:07:46 +08:00
morluto 486111725e refactor(apk): consume shared BER node facts
Remove the APK reader's pass-through children and content projections so format consumers read the shared BER owner's nodes directly. Keep only the encoded-span helper needed for exact issuer and certificate bytes, and describe CMS BER as this parser's structural owner.
2026-10-23 19:07:46 +08:00
morluto 40717c931b test(managed): retain derived facts in cloned method fixtures
Clone caller-scoped call and field facts with the fixture methods. Keep known CIL changes alongside unavailable target metadata in the missing-row controls.
2026-10-23 19:07:46 +08:00
morluto 142cf188a7 fix(artifacts): compare PyInstaller declaration facts
Compare stable producer-tagged declarations independently of materialized payloads. Preserve missing facts as unknown without applying PyInstaller rules to foreign metadata or nested container entries.

Fixes #6484
Fixes #6485
2026-10-23 19:07:46 +08:00
morluto c70eefad50 fix(managed): compare observed call targets
Compare aligned managed call edges by their reported declaring type and method name, keeping missing target facts unknown without comparing build-local tokens. Document the static comparison limits.

Fixes #6630
2026-10-23 19:07:46 +08:00
morluto 74c23005c0 fix(ptx): normalize parameter declarators once
Fixes #6606
2026-10-23 19:07:46 +08:00
morluto 9c4dd7eb23 fix(rust): preserve historical cargo-auditable feature facts
Accept observed feature arrays, preserve omitted values as unknown across producer revisions, and keep older retained reports compatible. Reuse bounded JSON sizing before graph expansion.

Fixes #6622
2026-10-23 19:07:46 +08:00
morluto 1ece9630e6 fix(pcap): retain absolute HTTP request targets
Reuse parsed URI facts and preserve uncertainty when mixed request records cannot all be resolved from the producer output.

Fixes #6537
2026-10-23 19:07:46 +08:00
morluto 4524bbd8df fix(qlog): mark records with unknown STREAM FIN incomplete
Keep known STREAM ranges and the unknown FIN value, while listing the source event among incomplete fact records so summary and retained views agree.

Fixes #6598
2026-10-23 19:07:46 +08:00
morluto d97db6ebaf fix(captures): preserve canonical TShark alias fields
TShark resolves selected field aliases before writing packet JSON. Keep the requested selector in Evidence while accepting the canonical field key produced for it.

Fixes #6595
2026-10-23 19:07:46 +08:00
morluto 25aa298c61 fix(gpu): preserve parameter and target declarations
Decode observed V2 CUDA parameters, retain qualified PTX parameter names and entry resource counts, and preserve family and feature target declarations through selection and consistency checks.

Fixes #6624
Fixes #6625
Fixes #6626
Fixes #6618
Fixes #6613
Fixes #6606
2026-10-23 19:07:46 +08:00
morluto 3a2074b633 fix(asn1): decode four-byte BER lengths unsigned
Accumulate length octets arithmetically so a four-octet length with bit 31 set remains a positive unsigned value and is rejected by the containing-range check rather than becoming a negative length.
2026-10-23 19:07:46 +08:00
morluto ef05713d86 fix(elf): reuse recognized machine architecture facts
Preserve the shared EM_HEXAGON classification in Go and Rust image reports.

Fixes #6629
2026-10-23 19:07:46 +08:00
morluto 48cd33af18 fix(signals): reject missing sigrok channels
Recognize the exact selected-channel diagnostic even when sigrok-cli exits successfully, while preserving partial producer output in the invalid-input details. Cover both public JSON adapters and add the missing-channel case to the Linux real-tool verifier.

Fixes #6631
2026-10-23 19:07:45 +08:00
morluto 80d3fd40f1 fix(adb): count Unicode requested permissions
Count requested-permission rows containing Unicode names, and keep counting subsequent rows in the same dumpsys section.

Fixes #6584
2026-10-23 19:07:45 +08:00