analysis_timeout_ms, max_heap_mb, and command_timeout_ms keep the source chosen by the caller, the runtime override, or the built-in default. A request value reports update_mode parameter because update_analysis_settings cannot change that call.
artifact_limits and web-network budgets report update_mode parameter because update_analysis_settings cannot change them. The legacy-name scan no longer reads docs, and the 2026-11-09 Ghidra receipts are restored to the fields they recorded.
Callers read update_mode to see whether update_analysis_settings can change a limit, and pending_restart only when a configured value is not active in this process.
The prepared full/full fixture takes 31.73 seconds on two CPU cores; restoring a 20 second child deadline causes a real bounded-run failure. Keep the 60 second child budget and 70 second outer deadline.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
A numeric parser now reads property and element accesses in its argument, so Number(process.env.REA_ARCHIVE_ENTRY_LIMIT) is a producer without a schema key. Template discovery keeps generated assignments and no longer treats a diagnostic sentence as a read.
A constructor copy is not a per-call read. Numeric limits also come from a number schema or a numeric parse, and the inventory no longer lists path and provider constants.
Object bindings, in-checks, and object keys that a spread can copy are producers. The architecture guard skips the TypeScript parse until typescript6 is installed, and the inventory links stay inside the published site.
Property access, element access, and helper-call arguments are producers. Comments and array literals are excluded by the tree, so a later argument such as read(environment, "REA_NEW_MAX_BYTES") stays classified.
Discovery no longer treats comments or registration-list entries as producers. The three limits moving on their own PRs must join ANALYSIS_SETTINGS; the exception registry cannot classify them.
* fix(native)!: enforce paired Swift literal coverage in shared dossiers
BREAKING CHANGE: Retained function dossiers containing only one Swift inventory are rejected. Regenerate observations through a canonical provider; both-absent unsupported observations remain valid.
* fix(contracts): advertise paired Swift literal coverage
* fix(reference): retain proven loader calls and unresolved targets
* refactor(reference): remove unused ancestor lookup
* fix(reference): drop loader calls that return a reassigned member
An immediate call could still use a member's original require initializer
because mutation facts were not built for a call-valued callee. A definite
assignment that precedes the call now replaces that initializer.
* fix(reference): select returned loaders from indexed read facts
* fix(reference): refresh loader facts for wrapped returned members
A sequence such as (0, box.load) still used the original require
initializer. Follow sequence, conditional, and logical returns to the
member before deciding whether a prior assignment replaced it.
* test(reference): record unresolved CommonJS targets in source evidence
unknown.cjs calls require with a non-literal target. The inventory now
keeps that coverage limitation on the file entry, and the boundary
fixture asserts it beside the resolved member relationships.
* fix(reference): cover opaque apply lists and assigned returned members
require.apply(null, args) has no normalized argument list, so the
inventory now records an unresolved target instead of complete coverage.
An assignment return such as f = box.load is followed to the member
before a prior replacement is trusted.
* fix(reference): keep self-defaulted module delegates loadable
Timing a member read at a later call made `box.load = box.load || null` observe its own write and drop the native delegate. Reads that already fed an earlier assignment stay at the member.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(elf): keep compressed storage out of decoded metadata facts
* fix(elf): preserve virtual relocation identity
Keep linked initializer backing and relocation values in their owning virtual
or ET_REL section coordinates. Replace the IL2CPP physical-copy materializer
with compact virtual value facts while preserving file-backed capacity.
Reuse initializer repairs and original regressions from ShuaixinHuang PRs
repair retains independent alias values instead of blanket alias refusal.
Co-authored-by: 帅鑫 Huang <1836656514@qq.com>
* fix(elf): admit compressed string tables the profile does not read
SHF_COMPRESSED string tables are rejected only when they name sections
or symbols. An unreferenced string table is not decoded, so it no longer
makes an otherwise analyzable ELF unsupported.
* fix(il2cpp): admit virtual pointer workspace before retention
* fix(elf): reject null relocation target sections
* fix(il2cpp): avoid decoding unrelated Mach-O words
* fix(il2cpp): preserve uncertainty in candidate scans
* fix(il2cpp): bound uncertain array candidates
* fix(il2cpp): preserve unknown registration candidates
* fix(il2cpp): classify type kinds before bound data
* fix(il2cpp): bind candidate counts to matching names
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: 帅鑫 Huang <1836656514@qq.com>
* fix(artifacts): keep an all-zero MD5 note as metadata
A Godot member with an all-zero MD5 records a limitation instead of a
digest. That note is the metadata difference from a member that claims
an MD5. A caveat without a one-sided integrity claim stays unchanged.
* fix(artifacts): compare declared digests without limitation text
A one-sided declared_integrity claim is already a metadata difference.
The limitation-array helper could not change that result and treated
unrelated observation caveats as source metadata. Remove it.
* test(artifacts): describe the one-sided MD5 claim as the metadata fact
The Godot acceptance case still expects metadata when one member has a
declared MD5 and the other has an all-zero MD5. That difference is the
missing claim, not the reader's limitation note.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(pe): 保留证书名称的 RDN 分组
* fix(pe): distinguish multi-valued RDNs in certificate name text
Join attributes that share an RDN with "+" and keep ", " between RDNs,
in encoded order. RFC 4514's RDN reversal is not applied, so names made
only of single-valued RDNs keep their existing spelling.
OID 2.5.4.10 is organizationName, so one RDN renders as
commonName=A+organizationName=B and two RDNs as
commonName=A, organizationName=B.
---------
Co-authored-by: AixSxT <245164663+AixSxT@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(verifiers): retain native cleanup ownership on failure
* fix(verification): load cleanup fixtures through the module resolver
CodeQL's local threat model treats file contents passed to
vm.SourceTextModule as user-controlled code execution. Import the real
verifier modules and redirect their dependencies to static mocks instead
of compiling script text read from disk.
* fix(verifiers): own CLI and MCP process families
* fix(verifiers): retire workspaces after cleanup retry
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(desktop): retain capture identity and cleanup ownership
* fix(desktop): validate destinations and finish inputs before export
* fix(desktop): preserve package ownership and apt trust boundaries
* fix(sqlite): preserve observed facts and distinguish special real values
* fix(desktop): bind computer files to data-object metadata
* test(desktop): count the tagged negative-zero cell spelling
SQLite view cells encode negative zero as a real object so it stays
distinct from the text "-0". The byte budget follows that spelling.
* fix(desktop): keep unresolved discovered state directories
Canonicalizing an unreadable path or dangling symlink aborted capture
before the inventory could record that the path was unknown. Those
discovered directories now keep their absolute spelling in the scope.
* test(desktop): keep the capture scope suite within its line limit
The unresolved state-directory case lives beside the suite so the
existing callback stays within the lint limit.
* fix(desktop): retain cancellation through capture input cleanup
* fix(desktop): avoid reserved Pydantic settings properties
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(javascript): preserve semantic facts across writes and implicit effects
* fix(javascript): preserve bundler identities and helper bindings
* fix(javascript): retain semantic graph evidence and coverage
* test(javascript): include the request link in endpoint traces
Response consumers now also link the originating request to the response, so an endpoint trace reports both that association and the response's json consumer.
* fix(javascript): keep source accessors known after a copied value escapes
An unknown computed getter makes accessor lookup consider every property.
A spread copy already records a value escape, and that escape was treated
as an unknown getter on the source, so the next read escaped the whole
object. Accessor lookup still fails closed for unknown writes and calls.
* fix(javascript): keep Object.defineProperty identified at its own call
The call that escapes Object was treated as a prior replacement of
defineProperty, so a descriptor value never replaced the exported sender
and bundled IPC paths were dropped.
* fix(javascript): keep Vite preload calls that precede reassignment
Helper identity used every write to the binding, so a later assignment
erased a call that had already read the canonical helper. Use the binding
value at the call when that order is known.
* fix(javascript): apply Vite cache mutations before a later reassignment
A later helper write made the whole-binding initializer check ignore an earlier cache mutation. Identity at that mutation uses the same ordered read as the call.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(ci)!: verify exact conformance fixture records
BREAKING CHANGE: Regenerate unversioned conformance manifests with npm run build:fixtures. Schema version 2 separates exact string markers from intentional fragments and rejects the ambiguous strings field.
* test(conformance): wait out a cold verifier instead of treating SIGTERM as rejection
The compiler-produced complete/REA_C_ENTRY run was killed by its 10s
execFile timeout on the loaded source-test runner, with empty stderr and
SIGTERM. The stricter record checks already passed locally and for the
other compiler-produced cases. Assert the process status and give that
cold run room inside the test budget.
* fix(ci): preserve carriage returns in nm symbol records
nm -j terminates each name with LF. A carriage return before that LF is
part of the symbol. Splitting on CR LF dropped it, so a renamed symbol
ending in CR matched the name without it.
* test(ci): supervise conformance verifier subprocesses
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(adb): reject unrepresentable activity arguments
* test(adb): lock complete activity component boundaries
The CLI and advertised schema still admitted a slash-free 512-character
component after admission required a nonempty package and class. Keep
that length sample rejected, admit a pattern-valid 512-character
component, and assert the typed field error.
* style(docs): format NTFS verification tables
oxfmt rejects the tables merged from main. The alignment is formatting
only, so static checks can run on this branch.
* test(adb): use a well-formed component for the length constraint
An over-long run of letters also fails the package/activity pattern, so the selector check reported both issues. The length fixture now has a valid component shape.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Cursor Agent