* fix(desktop): preserve own state keys in task witnesses
* test(desktop): preserve witness parse failure details
* fix(desktop): retain own column keys in task conditions
* fix(contracts): drop nested defaults from a root union sibling
Flattening a union of strict object groups lifts each group's properties
into one object. A default the scenario group carried inside
normalization.rules survived that lift even though the passive group
declares no normalization, so a client that fills nested defaults sent
{normalization: {rules: []}} and the runtime parser refused the call
with "Unrecognized key: normalization".
Remove defaults below a property that any group omits, not just the one
on the property itself. A property every group owns keeps its own
nested guidance.
* fix(contracts): keep a nested default a reference still targets
Dropping the nested default of a property a sibling group omits also removed defaults that references point into. A resource whose validation $ref targets its own default was advertised with that reference intact but its target gone, so the advertised schema no longer compiled in AJV or client projection.
Collect the paths into a default that references inside the branch target and keep those entries while stripping the rest. Other nested defaults are still removed, so the strict sibling group keeps refusing the object.
* test(contracts): type the root union default regression fixture
The fixture spread the canonical branch through a widened cast, so the repository typecheck rejected the spread and indexed access. Narrow the branch shape and guard the optional schema before collecting its referenced defaults.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
* docs(native): specify Windows ReFS filesystem authority
* docs(native): plan ReFS filesystem support
* feat(native): admit ReFS filesystem identities
* feat(native): support ReFS filesystem authority
* feat(native): advertise ReFS Windows support
* docs(native): format ReFS support documents
* docs(native): record ReFS verification tasks
* docs(native): record ReFS draft pull request
* docs(website): correct remaining ReFS translations
* fix(docs): correct Windows native guide link in ReFS plan
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(swift): classify private nested types by their own kind
Skip swiftc's file discriminator before the nominal marker so a private
nested enum, struct, or class is not filed under its enclosing type.
* ci: retrigger checks stuck in the Actions queue
The original workflow runs stayed queued while later runs on other
pull requests completed.
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Admission compared table offsets with the class minimum, so a larger e_ehsize still parsed those header bytes as program or section entries.
Co-authored-by: Cursor <cursoragent@cursor.com>
CSP3 requires a complete base64-value, so truncated and illegal nonce
and hash tokens were being reported as real sources.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(setup): support Cline as a client
* test(setup): cover Cline doctor and uninstall ownership
* docs(setup): document Cline support
* test(setup): verify Cline against an installed client
* test(setup): include Cline in the exhaustive client detection list
* docs(setup): note that a hand-written rea entry blocks Cline setup
* fix(setup): isolate Cline verification and await MCP discovery
* fix(verification): own and isolate Cline discovery
* fix(setup): preserve native Cline transport settings
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
cctools lipo prints CPU_TYPE_I386 and CPU_SUBTYPE_I386_ALL for i386 slices, so their CPU codes were unknown and every i386 slice carried unnormalized-text limitations.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(hardening): recognize the __chk_fail FORTIFY handler import
glibc exports __chk_fail as the shared failure handler that most FORTIFY
checks funnel into, and its dynamic import is a positive sign that the
binary uses FORTIFY. The ELF FORTIFY matcher accepted __fortify_fail and
__*_chk names, so an image whose only relevant import was __chk_fail was
reported as fortify: unknown with no evidence location.
* style(hardening): wrap the __chk_fail fixture call to the formatter's width
format:check fails on the current head because the new fixture call fits on one line at the file's previous width but exceeds oxfmt's 80-column limit with the longer fortifyName literal.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
parseCaptureJson retained the strings jsonc-parser 3.3.1 builds fragment by
fragment around each escape, which V8 keeps as ropes several times larger
than their text. Escape-heavy HAR captures therefore exhausted the 192 MiB
decoder heap from about 15 MB, well inside the 32 MiB input budget.
Each string token is now decoded with JSON.parse from its accepted source
span, which yields the same value as one flat string. jsonc-parser reports
malformed strings through onError before the value callback, so JSON.parse
only sees tokens it already accepted. HAR, qlog and Playwright trace
decoding share this parser.
Fixes#10132
Kaoru0822