* refactor(platform): give the host platform one owner and ratchet ambient process.platform reads
* refactor(process): pass the host platform to process sampling instead of reading it ambiently
#10755 added two process.platform reads (ps selection in process sampling and the
desktop build doctor's ps fact) after the host-platform ratchet was measured.
The desktop fact already receives the host platform from doctor; process sampling
now receives it from the capture harness, removing all five ambient reads there.
* refactor(errors): give caller aborts a typed reason at the adapters
Squashes 908813551f, 87858de4dc (fix(mcp): preserve cancellation reasons in handlers) and fa151dc3f6 (test(server): race handler-entry gates against the triggering tool call) onto main without #10566's pre-squash commits.
* refactor(errors): give owner-initiated aborts a typed reason outside the browser adapters (#10692)
* refactor(errors): give owner-initiated aborts a typed reason outside the browser adapters
* refactor(verify): keep the abort-reason scan receiver-independent
Playwright's route.abort takes a network error code; the one call site now names its default code instead of the guard exempting a variable name.
* refactor(browser): give owner-initiated CDP aborts typed reasons (#10706)
* refactor(browser): give owner-initiated CDP aborts typed reasons
* fix(browser): give the page-side request fetch page-native abort reasons
The request callback runs in the page through page.evaluate and cannot
reach REA's modules. Define its deadline and cleanup reasons as
DOMExceptions inside the callback, and make the test fake evaluate the
callback from its source so module imports are unavailable, as in a page.
* test(process): expect the reader close's typed owner reason
Closing the Darwin run-token reader aborts its compilation with OwnerCancellation.ownerClosed since the owner-abort change in this PR; the boundary test still expected the default DOMException.
* fix(server): report HTTP session replacement and shutdown to pending tools as an owner close
* refactor(errors): read cleanup completion from dependencies instead of pushing it to dependents
AnalysisError.cleanupIncomplete becomes a getter over the error's own unresolved state and its bound dependencies. The WeakRef dependents graph and resolveCleanup's push propagation are removed, and subclasses mark their initial state through markCleanupIncomplete instead of overriding a public mutable field.
* fix(errors): settle bound dependencies before binding more
A composite whose dependencies had released but whose status was never read
stayed incomplete when a later dependency was bound.
* refactor(errors): let errors read a lease group's release instead of resolving them (#10759)
AnalysisCleanupLeaseGroup no longer calls resolveCleanup() on its error.
The error holds the group as a release claim and reads cleanupReleased when
asked, so completion follows the lease owner without a push.
* chore(verify): count resolveCleanup and bindCleanupDependencies calls so they only shrink (#10763)
* refactor(errors): let errors read a lease group's release instead of resolving them
AnalysisCleanupLeaseGroup no longer calls resolveCleanup() on its error.
The error holds the group as a release claim and reads cleanupReleased when
asked, so completion follows the lease owner without a push.
* chore(verify): count resolveCleanup and bindCleanupDependencies calls so they only shrink
* refactor(process): let worker cleanup errors read their root epoch's release
OwnedWorkerRuntime's root epoch is now an AnalysisCleanupReleaseClaim. Errors bound to it read its release when asked instead of the epoch pushing resolveCleanup() through weak references, and a runtime without a retained root binds an already-released owner. Removes the OwnedWorkerCleanupFailure structural type and four resolveCleanup() pushes; the counted baseline shrinks accordingly.
* refactor(pcap): let pcap cleanup errors read command and snapshot release (#10792)
Retained pcap commands, retained snapshot failures and snapshot completion descriptors now own their release and errors read it: commands and snapshot failures implement AnalysisCleanupReleaseClaim, and a failed completion-descriptor close is retried through an AnalysisCleanupLease bound to its error. Removes four resolveCleanup() pushes; the counted baseline shrinks accordingly.
* refactor(process): let Darwin helper cleanup errors read their owner's release
Darwin helper cache and run-token reader root cleanup now record an AnalysisCleanupRelease that every failure reports; a successful retry confirms it. Replaces the first-failure anchor that later failures depended on and the resolveCleanup() push. Removes two resolveCleanup() and two bindCleanupDependencies() calls; both counted baselines shrink.
* refactor(ghidra): let Ghidra cleanup errors read the client's and checkpoint's release (#10802)
GhidraClient and GhidraCheckpoint bind each cleanup failure to an AnalysisCleanupRelease and confirm it when a later close or retry releases everything, instead of keeping a set of failures and pushing resolveCleanup() to each. Removes two resolveCleanup() calls; the counted baseline shrinks.
* refactor(native): read retained inventory views through the operation fact contracts
* refactor(native): read matching inventories through the operation fact contracts (#10887)
* refactor(native): read dispatch symbol fallbacks as lenient name facts at the port (#10889)
* refactor(native): read dispatch symbol fallbacks as lenient name facts at the port
* test(native): accept undeclared name-row fields in both dispatch consumers
* refactor(native): read literal searches and overview counts as operation facts (#10894)
* refactor(native): read literal searches and overview counts as operation facts
* refactor(native): read addressed inventory rows as operation facts in every reader (#10899)
* refactor(native): read addressed inventory rows as operation facts in every reader
* test(native): cover xrefs name resolution through the name fact contract
* test(server): pin procedure completion to the procedure inventory contract
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): re-emit advertised patterns in a portable regex grammar
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): preserve schema widening through references
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* fix(mcp): keep references valid when presentation widens their targets
* fix(mcp): relax references into negations and conditionals presentation may remove
* fix(mcp): keep astral literals and dynamic references widening in every mode
* fix(mcp): omit astral literals and relax untracked references when presentation widens
* fix(mcp): read reference pointers by schema position, not segment spelling
* fix(mcp): protect references into collapsing boolean unions and keep referencing branches out of the collapse
* fix(mcp): omit patterns whose classes name astral characters
* fix(mcp): decide union collapse and pointer protection from canonical branches
* docs(mcp): document non-u astral matching and pin BMP agreement across V8 modes
* test(mcp): expect the advertised base64 schema to omit the unbounded pad-bit probe
* fix(mcp): protect references into unevaluated keywords lost evaluation removes
* fix(mcp): emit stack-safe classes with non-ASCII members and protect draft-07 reference siblings
* fix(mcp): protect references into literal siblings of relaxed draft-07 references
* refactor(domain): one owner for the non-array record predicate
Thirty-four source files each declared isRecord as a non-null object that is
not an array, and six more spelled the same predicate as isObject,
isSchemaRecord or isStorageRecord. They now import isRecord from
src/domain/isRecord.ts, whose overloads keep JsonValue narrowing for the
desktop and environment readers. DshCordisPatch's predicate also excludes
Cordis expressions, so it is renamed isPatchRecord.
architecture-guards refuses a new local copy under any name. The seven files
that still hold one are listed and must leave the list when their copy goes.
* fix(guards): count record predicate copies precisely
* test(hopper): retry after confirmed application exit
* fix: reject stale record predicate exceptions
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* refactor(process): build infrastructure cancellations with a required reason
Migrate every AnalysisCancelledError construction in shared process,
provider, artifact, domain, server and CLI code and in the smaller
providers to cancelledBy, lowering the guard baseline from 671 to 566.
Option bags that carried a cause are split so the cancellation branch
cannot receive one.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
* refactor(native): select ELF sections through the keyed owner
* test(native): pin returned exports and versions for repeated version sections
* refactor(nativeaot): read neither of repeated frozen object regions (#10790)
* refactor(nativeaot): read neither of repeated frozen object regions through the keyed owner
* refactor(parsers): retire every first-match section lookup (#10793)
* fix(nativeaot): report an ambiguous frozen object region as partial (#10812)
* refactor(native): select program headers and load commands through the keyed owner (#10827)
* refactor(native): select the GOT base and dependency segments through the keyed owner (#10847)
* refactor(native): select the GOT base and dependency segments through the keyed owner
resolveGotBase selects the SHT_DYNAMIC section and the allocated .got.plt/.got sections with uniqueKeyed, so a repeat leaves the GOT base unknown instead of taking the first match; elfDependencies reads PT_LOAD segments through the same keyed program table as PT_DYNAMIC. A new keyed-first-match guard recognizes a find/findLast or filter-then-[0] whose predicate compares a key field, whatever the table is called; existing matches are baselined. The unwind fixture can declare PT_DYNAMIC headers and repeated .dynamic/.got.plt sections.
* test(native): pin the PT_DYNAMIC path and destructured keyed lookups
The keyed-first-match guard moves to scripts/verify/keyed-first-match.mjs with focused tests, and now recognizes a destructured key in any position and a destructured filter predicate. The single PT_DYNAMIC unwind test declares .dynamic as SHT_PROGBITS so only the program header supplies DT_PLTGOT, and asserts the resolved ranges.
* fix(macho): refuse repeated chained-fixup and dyld-info tables (#10850)
parseMachoLayout kept the last LC_DYLD_CHAINED_FIXUPS range and merged the rebase/bind streams of every LC_DYLD_INFO(_ONLY) command. A repeat now refuses the slice as malformed. NativeMachoInspection's chained import-name reader already declined repeated LC_DYLD_CHAINED_FIXUPS; that rule is now covered by a test.
* fix(verify): count a filter index only on the filter's own result
* ci(windows): validate host-absolute path schemas in the Windows lane
Windows hosts advertise their own absolute-path pattern (#7151). The lane
compiled it through advertisedDialect.test.ts but never validated a Windows
path against it. Run absoluteLocalPathSchema.test.ts there, select the lane
when the pattern's owner changes, and guard both schema checks in the lane.
Refs #10517
* ci(windows): run live MCP schema validity in the Windows lane
toolSchemaValidity.test.ts compared the live advertisement with the
POSIX-generated .cache/mcp-tool-catalog.json, so it could not run where
the Windows lane skips artifact generation. Move the generated-catalog
cases into generatedToolCatalog.test.ts, share the reference walkers
through the advertised-schema fixture, and add the live-server file to
the curated Windows lane and its scope.
* refactor(errors): read cleanup completion from dependencies instead of pushing it to dependents
AnalysisError.cleanupIncomplete becomes a getter over the error's own unresolved state and its bound dependencies. The WeakRef dependents graph and resolveCleanup's push propagation are removed, and subclasses mark their initial state through markCleanupIncomplete instead of overriding a public mutable field.
* fix(errors): settle bound dependencies before binding more
A composite whose dependencies had released but whose status was never read
stayed incomplete when a later dependency was bound.
* refactor(errors): let errors read a lease group's release instead of resolving them (#10759)
AnalysisCleanupLeaseGroup no longer calls resolveCleanup() on its error.
The error holds the group as a release claim and reads cleanupReleased when
asked, so completion follows the lease owner without a push.
* chore(verify): count resolveCleanup and bindCleanupDependencies calls so they only shrink (#10763)
* refactor(errors): let errors read a lease group's release instead of resolving them
AnalysisCleanupLeaseGroup no longer calls resolveCleanup() on its error.
The error holds the group as a release claim and reads cleanupReleased when
asked, so completion follows the lease owner without a push.
* chore(verify): count resolveCleanup and bindCleanupDependencies calls so they only shrink
* refactor(process): let worker cleanup errors read their root epoch's release
OwnedWorkerRuntime's root epoch is now an AnalysisCleanupReleaseClaim. Errors bound to it read its release when asked instead of the epoch pushing resolveCleanup() through weak references, and a runtime without a retained root binds an already-released owner. Removes the OwnedWorkerCleanupFailure structural type and four resolveCleanup() pushes; the counted baseline shrinks accordingly.
* refactor(pcap): let pcap cleanup errors read command and snapshot release (#10792)
Retained pcap commands, retained snapshot failures and snapshot completion descriptors now own their release and errors read it: commands and snapshot failures implement AnalysisCleanupReleaseClaim, and a failed completion-descriptor close is retried through an AnalysisCleanupLease bound to its error. Removes four resolveCleanup() pushes; the counted baseline shrinks accordingly.
* refactor(gdb): parse MI result records with one typed record parser
GdbSessionManager recognized ^done with a prefix regex at seven sites, kept a hand-written span scanner and a second character scanner for -list-thread-groups, and decoded C-string fields with a dynamic RegExp. src/gdb/GdbMiRecord.ts now parses a result record into its token, class and typed results (C-string bytes, tuples, value lists and result lists), and returns a typed malformed-mi-record failure with a reason and offset. The done checks, the thread-group PID inventory and the C-string field reader use it; the stream dispatcher reads only the record header through the same module. An architecture guard keeps MI result-record regexes in the owner.
* perf(gdb): encode each unescaped C-string run once
The MI C-string decoder allocated a Buffer per unescaped character, pushed every byte into a number array, and copied the rest of the line for each hex or octal escape. It now validates unescaped runs in place, encodes each run once, reads escapes with sticky patterns, and joins the chunks once. On a 12.1 MiB groups reply: 887/832 ms elapsed and 818/775 ms CPU before, 76/76 ms elapsed and 131/128 ms CPU after; peak RSS 152-170 MiB both.
* test(gdb): refuse a malformed ^done for a startup setting through a real session
A fake GDB answers -gdb-set auto-load off with ^done,msg="unterminated. The session must not start: the typed MI record parser refuses the record, where main's ^done prefix match accepted it (the case fails against main's GdbSessionManager).
* feat(gdb): record the GDB version from -gdb-version in session Evidence (#10865)
* feat(gdb): record the GDB version from -gdb-version in session Evidence
Startup now asks -gdb-version before the auto-load setting and reads its first console stream record through a new MI stream-record parser (parseGdbMiStreamRecord). Each session's Evidence names that version; an unrecognised banner, malformed record or refused query leaves it null (unknown), as before.
Fake GDB fixtures answer -gdb-version from one owner in gdbTestHelpers: a stdin preamble for scripted fakes and answerFakeGdbStartup for in-process fakes, so scenarios model only their own commands.
* fix(gdb): leave a lossily decoded version unknown and frame fake startup replies by line
* test(gdb): reject unmodeled commands in the lossy version banner fixture
* test(gdb): refuse commands the scripted fake GDBs do not model (#10947)
* test(gdb): refuse commands the scripted fake GDBs do not model
* test(gdb): match the migrated fakes' special commands exactly
The case checks that a one-shot CLI exits after a retained-cleanup
failure and that the operating system then releases the Hopper target
lease to a retry. Since #10412, `cli.run` serves plain commands on the
file's shared CLI process. That process keeps the lease, as the
cleanup-ownership rules require while cleanup is incomplete, and never
exits between commands, so the retry was refused as "already open" and
the final lease check failed on macOS.
Run both attempts with `freshProcess: true`, which the fixture provides
for process-exit facts. The case is macOS-only because target leases
are taken only on the macOS launcher route, and no CI lane ran it, so
add it to the Apple lane and its change scope.
* refactor(python): read pyc and PYZ marshal values through one shared reader
* refactor(python): read pyc 64-bit values and header fields through shared readers (#10834)
* refactor(limits): declare the Node timer bound and duration schema once
Fifteen modules re-declared 2_147_483_647 as their own timer maximum and
eleven built the same 1..2^31-1 millisecond schema. They now use
MAX_NODE_TIMER_DELAY_MS and timerDurationMsSchema from
src/domain/analysisResourceLimits.ts, and an architecture guard rejects the
literal outside that owner and five non-timer int32 bounds. The generated
MCP tool catalog is byte-identical.
* refactor(limits): keep the JVM processor-count bound separate from the timer bound
REA_JADX_ACTIVE_PROCESSOR_COUNT is a Java int count, not a timer delay, so it keeps its own named bound and a documented exception in the signed 32-bit guard. Remove the timer-bound and zod imports the duration-schema migration left unused.
* refactor(limits): keep the TShark packet-count bound separate from the timer bound
packet_limit is passed to TShark's -c as a C int packet count, not a timer delay, so it keeps its own named bound and a documented exception in the signed 32-bit guard.
* fix(pcap): report a refused tool launch as an unavailable tool
When a capture read's tool launch was refused with EPERM, pcap reported it
as unreadable tool output (AnalysisProtocolError) instead of an unavailable
tool. Pcap also never told "not executable" apart from "missing".
Add classifyLaunchFailure in src/process as the one owner of which spawn
errnos mean missing (ENOENT, ENOTDIR) and which mean present but not
executable (EACCES, EPERM, ENOEXEC, EISDIR). Pcap, apktool and gdb used three
different errno lists; all three now use it.
* refactor(process): classify owned command outcomes through one owner
Add ProviderOutcome, read once from the supervisor's facts, and classifyProviderOutcome, the one mapping from an outcome to a typed error. Migrate pcap and the shared artifact producer command failure (TShark, sigrok). Add the rea/provider-failure-classifier lint rule with a shrink-only baseline of per-site (cause: unknown) => AnalysisError functions.
* refactor(process): classify Java and adb launch refusals with the shared owner (#10598)
The Ghidra and JADX Java probes and adb's version probe now take
missing-versus-not-executable from classifyLaunchFailure instead of their
own errno checks. ELOOP and ENAMETOOLONG join the owner's missing set, so
adb keeps its existing classification and both Java probes now treat a
non-directory path component as a missing runtime.
* fix(pcap): preserve command launch attribution
* test(pcap): expect an unknown failing stage when a limited capture tool exits unsuccessfully
* refactor(process): classify owned command outcomes through one owner
Add ProviderOutcome, read once from the supervisor's facts, and classifyProviderOutcome, the one mapping from an outcome to a typed error. Migrate pcap and the shared artifact producer command failure (TShark, sigrok). Add the rea/provider-failure-classifier lint rule with a shrink-only baseline of per-site (cause: unknown) => AnalysisError functions.
* test(lint): cover baselined files in the provider-failure classifier rule
* fix(apktool): report the decoder JVM's heap exhaustion as memory, not a target refusal
The supervisor now watches for a managed runtime's out-of-memory report while output streams (JVM java.lang.OutOfMemoryError, V8 'JavaScript heap out of memory'), so a retention budget cannot hide it. ProviderOutcome gains a runtime-exhausted kind and classifyProviderOutcome maps it once. Apktool decode opts in and moves to the shared classifier; Ghidra's single-purpose output token becomes the JVM runtime option and its area matching reuses the shared table.
* fix(process): keep the runtime's out-of-memory report on the memory error it supports
* fix(pcap): attribute a limited capture's exit through the prlimit wrapper
* fix(process): keep a shortened out-of-memory line marked as shortened
* fix(process): identify the refused executable for every launcher shape
Name the executable on errnos Node throws synchronously from spawn
(ENOEXEC, ENOTDIR, ...) and read the Windows native launcher's
executable-launch constraint, so pcap attributes those refusals to the
selected tool or limiter instead of an unknown stage.
* test(pcap): prove synchronous launch naming with ENOTDIR on every POSIX host
* fix(apktool): advise the JVM limit that governs the reported memory area
* fix(ghidra): read the supervisor's parsed OOM area instead of reparsing lines
* fix(sqlite,capture): read V8 heap exhaustion from streamed output, not retained stderr (#10724)
The SQLite worker and the Node capture decoders now declare runtime: "v8", so the supervisor observes V8's heap report as output streams. Both classifiers read the runtime-exhausted outcome instead of matching retained stderr, so a report beyond the retention budget, or one whose process then overflowed its output budget, is still reported as memory exhaustion.
* refactor(evm): classify EVMole worker outcomes through the shared provider classifier (#10716)
* refactor(evm): classify EVMole worker outcomes through the shared provider classifier
The EVMole worker's cancellation, deadline, output budget and CPU/file-size signals now go through classifyProviderOutcome; only the prlimit launch refusal and the reserved EFBIG exit remain in its dialect. The worker is opted into V8 exhaustion scanning so a heap report names its fixed 256 MiB heap. providerOutcomeOf now reads a launch refusal only from a spawn errno, so a private-storage or carrier read errno is no longer reported as a limiter launch failure.
* fix(evm): keep a stream failure's exit status and update Linux worker expectations
* refactor(process): read launch refusals through the launcher identity owner
* refactor(wasm): classify WABT command outcomes through the shared provider classifier (#10727)
* refactor(wasm): classify WABT command outcomes through the shared provider classifier
WABT's cancellation, command deadline, output budget, and inherited-limit signals now go through classifyProviderOutcome; its dialect keeps only the configuration-probe and launch-refusal unavailability and the unclassified-exit output error. A tool ended by SIGXCPU/SIGXFSZ or the memory limit is now a resource constraint instead of an output error, and a refused launch in the producer phase is reported as unavailable. The shared timeout context gains the analysis setting that selected the deadline, and the output-limit context may name its exceeded budget.
* fix(wasm): keep setup guidance when a WABT version probe's output cannot be collected
* refactor(providers): classify raw provider failures through one owner
* refactor(process): build classified cancellations with cancelledBy and the carried caller reason
* chore(lint): count runOwned's close-failure mapper from main in the classifier baseline
* fix(process): carry the runtime's exhaustion report on every memory error that claims it
SQLite and historical-capture memory errors recognised a streamed V8 heap report but dropped it, so a report outside retained output reached callers without its source line or omission flags. One projection, runtimeExhaustionReport, now owns that shape for the shared classifier and both consumers. Also lowers the EVMole and WABT cancellation-constructor baselines.
* fix(process): keep the provider's recovery for a native-thread exhaustion report
The shared classifier replaced the provider-supplied recovery with generic capacity advice whenever the JVM reported it could not create a native thread, dropping Apktool's launcher guidance and flipping retryable to true. The provider's recovery now wins; the capacity advice remains the fallback for providers that supply none.
* refactor(pwntools): classify pwntools failures through the shared provider classifier (#10782)
* refactor(pwntools): classify pwntools failures through the shared provider classifier
pwntools' per-site classifier is replaced by pwntoolsFailureDialect for classifyProviderFailure. Command outcomes go through classifyProviderOutcome, launch refusals through launcherRefusalOf instead of a 'spawn ' syscall prefix check, the input limit through the file dialect's fileSize, and the cleanup report through commandCleanup. The shared read cancellation now carries the reader's partial observation, and resource-signal reports accept provider detail.
* fix(pwntools): report a failed command's output once and expect resource_constraint for overflow
The shared outcome owner already attaches the command's output as capturedOutput, so the pwntools adapter fallback no longer copies the same text into diagnostics.stdout, diagnostics.stderr and diagnostics.captured_output; diagnostics keep the exit facts. Update the overflow expectations the dialect migration missed (layout provider cleanup and over-budget rows, pwntools cleanup) to resource_constraint.
* refactor(pcap): read tshark JSON packets through one envelope owner
PcapOutput and the packet-capture reader each decoded tshark -T json and checked the packet envelope. The capture reader let SyntaxError escape and accepted any shape until its field schema ran. src/pcap/TsharkJsonPackets.ts now owns the envelope (malformed JSON, the packet array, each packet's _source.layers) as typed failures, and the pcap byte and expansion budget. Both consumers map those failures to their existing error kinds. An architecture guard keeps _source.layers reads in the owner.
* fix(captures): keep producer output on a refused packet reply
parsePacketOutput threw AnalysisOutputError itself, so the provider's failure mapping returned it without the captured stdout and stderr, both for envelope refusals and for unordered or out-of-limit frames. It now returns a Result with the reason and cause, and the provider builds the AnalysisOutputError with capturedOutput.
* feat(captures): bound packet-capture JSON expansion by an adjustable setting
The capture path parsed TShark's selected-field JSON without the expansion
estimate the pcap reader charges. It now reads through readTsharkJsonPackets
under capture.packet_json_expansion_bytes (REA_CAPTURE_PACKET_JSON_EXPANSION_BYTES).
The estimate charges at most 130 bytes per code unit and the output is one
Node string, so no admissible output reaches 69,793,215,440 bytes; the default
and maximum are 128 GiB, so the budget refuses only when lowered. A refusal is
an adjustable_budget resource constraint naming the setting and keeps the
producer output; a malformed launch seed is refused before the capture is read.
* refactor(errors): read cleanup completion from dependencies instead of pushing it to dependents
AnalysisError.cleanupIncomplete becomes a getter over the error's own unresolved state and its bound dependencies. The WeakRef dependents graph and resolveCleanup's push propagation are removed, and subclasses mark their initial state through markCleanupIncomplete instead of overriding a public mutable field.
* fix(errors): settle bound dependencies before binding more
A composite whose dependencies had released but whose status was never read
stayed incomplete when a later dependency was bound.
* refactor(errors): let errors read a lease group's release instead of resolving them (#10759)
AnalysisCleanupLeaseGroup no longer calls resolveCleanup() on its error.
The error holds the group as a release claim and reads cleanupReleased when
asked, so completion follows the lease owner without a push.
* chore(verify): count resolveCleanup and bindCleanupDependencies calls so they only shrink (#10763)
* refactor(errors): let errors read a lease group's release instead of resolving them
AnalysisCleanupLeaseGroup no longer calls resolveCleanup() on its error.
The error holds the group as a release claim and reads cleanupReleased when
asked, so completion follows the lease owner without a push.
* chore(verify): count resolveCleanup and bindCleanupDependencies calls so they only shrink
* fix(pcap): report a refused tool launch as an unavailable tool
When a capture read's tool launch was refused with EPERM, pcap reported it
as unreadable tool output (AnalysisProtocolError) instead of an unavailable
tool. Pcap also never told "not executable" apart from "missing".
Add classifyLaunchFailure in src/process as the one owner of which spawn
errnos mean missing (ENOENT, ENOTDIR) and which mean present but not
executable (EACCES, EPERM, ENOEXEC, EISDIR). Pcap, apktool and gdb used three
different errno lists; all three now use it.
* refactor(process): classify owned command outcomes through one owner
Add ProviderOutcome, read once from the supervisor's facts, and classifyProviderOutcome, the one mapping from an outcome to a typed error. Migrate pcap and the shared artifact producer command failure (TShark, sigrok). Add the rea/provider-failure-classifier lint rule with a shrink-only baseline of per-site (cause: unknown) => AnalysisError functions.
* refactor(process): classify Java and adb launch refusals with the shared owner (#10598)
The Ghidra and JADX Java probes and adb's version probe now take
missing-versus-not-executable from classifyLaunchFailure instead of their
own errno checks. ELOOP and ENAMETOOLONG join the owner's missing set, so
adb keeps its existing classification and both Java probes now treat a
non-directory path component as a missing runtime.
* fix(pcap): preserve command launch attribution
* test(pcap): expect an unknown failing stage when a limited capture tool exits unsuccessfully
* refactor(process): classify owned command outcomes through one owner
Add ProviderOutcome, read once from the supervisor's facts, and classifyProviderOutcome, the one mapping from an outcome to a typed error. Migrate pcap and the shared artifact producer command failure (TShark, sigrok). Add the rea/provider-failure-classifier lint rule with a shrink-only baseline of per-site (cause: unknown) => AnalysisError functions.
* test(lint): cover baselined files in the provider-failure classifier rule
* fix(apktool): report the decoder JVM's heap exhaustion as memory, not a target refusal
The supervisor now watches for a managed runtime's out-of-memory report while output streams (JVM java.lang.OutOfMemoryError, V8 'JavaScript heap out of memory'), so a retention budget cannot hide it. ProviderOutcome gains a runtime-exhausted kind and classifyProviderOutcome maps it once. Apktool decode opts in and moves to the shared classifier; Ghidra's single-purpose output token becomes the JVM runtime option and its area matching reuses the shared table.
* fix(process): keep the runtime's out-of-memory report on the memory error it supports
* fix(pcap): attribute a limited capture's exit through the prlimit wrapper
* fix(process): keep a shortened out-of-memory line marked as shortened
* fix(process): identify the refused executable for every launcher shape
Name the executable on errnos Node throws synchronously from spawn
(ENOEXEC, ENOTDIR, ...) and read the Windows native launcher's
executable-launch constraint, so pcap attributes those refusals to the
selected tool or limiter instead of an unknown stage.
* test(pcap): prove synchronous launch naming with ENOTDIR on every POSIX host
* fix(apktool): advise the JVM limit that governs the reported memory area
* fix(ghidra): read the supervisor's parsed OOM area instead of reparsing lines
* fix(sqlite,capture): read V8 heap exhaustion from streamed output, not retained stderr (#10724)
The SQLite worker and the Node capture decoders now declare runtime: "v8", so the supervisor observes V8's heap report as output streams. Both classifiers read the runtime-exhausted outcome instead of matching retained stderr, so a report beyond the retention budget, or one whose process then overflowed its output budget, is still reported as memory exhaustion.
* refactor(evm): classify EVMole worker outcomes through the shared provider classifier (#10716)
* refactor(evm): classify EVMole worker outcomes through the shared provider classifier
The EVMole worker's cancellation, deadline, output budget and CPU/file-size signals now go through classifyProviderOutcome; only the prlimit launch refusal and the reserved EFBIG exit remain in its dialect. The worker is opted into V8 exhaustion scanning so a heap report names its fixed 256 MiB heap. providerOutcomeOf now reads a launch refusal only from a spawn errno, so a private-storage or carrier read errno is no longer reported as a limiter launch failure.
* fix(evm): keep a stream failure's exit status and update Linux worker expectations
* refactor(process): read launch refusals through the launcher identity owner
* refactor(wasm): classify WABT command outcomes through the shared provider classifier (#10727)
* refactor(wasm): classify WABT command outcomes through the shared provider classifier
WABT's cancellation, command deadline, output budget, and inherited-limit signals now go through classifyProviderOutcome; its dialect keeps only the configuration-probe and launch-refusal unavailability and the unclassified-exit output error. A tool ended by SIGXCPU/SIGXFSZ or the memory limit is now a resource constraint instead of an output error, and a refused launch in the producer phase is reported as unavailable. The shared timeout context gains the analysis setting that selected the deadline, and the output-limit context may name its exceeded budget.
* fix(wasm): keep setup guidance when a WABT version probe's output cannot be collected
* refactor(process): build classified cancellations with cancelledBy and the carried caller reason
* chore(lint): count runOwned's close-failure mapper from main in the classifier baseline
* fix(process): carry the runtime's exhaustion report on every memory error that claims it
SQLite and historical-capture memory errors recognised a streamed V8 heap report but dropped it, so a report outside retained output reached callers without its source line or omission flags. One projection, runtimeExhaustionReport, now owns that shape for the shared classifier and both consumers. Also lowers the EVMole and WABT cancellation-constructor baselines.
* fix(process): keep the provider's recovery for a native-thread exhaustion report
The shared classifier replaced the provider-supplied recovery with generic capacity advice whenever the JVM reported it could not create a native thread, dropping Apktool's launcher guidance and flipping retryable to true. The provider's recovery now wins; the capacity advice remains the fallback for providers that supply none.
* refactor(browser): send only CDP commands with registered result schemas
* refactor(browser): open Playwright CDP sessions only through the registered-command owner
* fix(browser): keep the restore obligation for an applied override with a malformed reply
A schema-rejected success reply means the browser applied the Emulation
override, so the attached environment owner records the reset obligation
before reporting the protocol error. Only a rejected or unanswered command
leaves no obligation.
* refactor(browser): open verifier-script CDP sessions through the registered-command owner (#10710)
* fix(browser): register the CDP commands JavaScript verifiers send
The verifier scripts send Browser.close, Page.createIsolatedWorld, Page.navigate, Page.reload, Target.activateTarget, Target.closeTarget and Target.createTarget through CdpConnection, which now admits every reply through its command's result schema. Register those schemas, refuse an unregistered run-time name as a typed malformed reply instead of a TypeError, and check script send literals against the registry.
* fix(browser): keep Target.closeTarget's success member for the verifiers
* fix(pcap): report a refused tool launch as an unavailable tool
When a capture read's tool launch was refused with EPERM, pcap reported it
as unreadable tool output (AnalysisProtocolError) instead of an unavailable
tool. Pcap also never told "not executable" apart from "missing".
Add classifyLaunchFailure in src/process as the one owner of which spawn
errnos mean missing (ENOENT, ENOTDIR) and which mean present but not
executable (EACCES, EPERM, ENOEXEC, EISDIR). Pcap, apktool and gdb used three
different errno lists; all three now use it.
* refactor(process): classify owned command outcomes through one owner
Add ProviderOutcome, read once from the supervisor's facts, and classifyProviderOutcome, the one mapping from an outcome to a typed error. Migrate pcap and the shared artifact producer command failure (TShark, sigrok). Add the rea/provider-failure-classifier lint rule with a shrink-only baseline of per-site (cause: unknown) => AnalysisError functions.
* refactor(process): classify Java and adb launch refusals with the shared owner (#10598)
The Ghidra and JADX Java probes and adb's version probe now take
missing-versus-not-executable from classifyLaunchFailure instead of their
own errno checks. ELOOP and ENAMETOOLONG join the owner's missing set, so
adb keeps its existing classification and both Java probes now treat a
non-directory path component as a missing runtime.
* fix(pcap): preserve command launch attribution
* test(pcap): expect an unknown failing stage when a limited capture tool exits unsuccessfully
* refactor(process): classify owned command outcomes through one owner
Add ProviderOutcome, read once from the supervisor's facts, and classifyProviderOutcome, the one mapping from an outcome to a typed error. Migrate pcap and the shared artifact producer command failure (TShark, sigrok). Add the rea/provider-failure-classifier lint rule with a shrink-only baseline of per-site (cause: unknown) => AnalysisError functions.
* test(lint): cover baselined files in the provider-failure classifier rule
* fix(pcap): attribute a limited capture's exit through the prlimit wrapper
* fix(process): identify the refused executable for every launcher shape
Name the executable on errnos Node throws synchronously from spawn
(ENOEXEC, ENOTDIR, ...) and read the Windows native launcher's
executable-launch constraint, so pcap attributes those refusals to the
selected tool or limiter instead of an unknown stage.
* test(pcap): prove synchronous launch naming with ENOTDIR on every POSIX host
* refactor(process): build classified cancellations with cancelledBy and the carried caller reason
* chore(lint): count runOwned's close-failure mapper from main in the classifier baseline
* refactor(process): own deadlines as one monotonic type with a finalize budget
Deadline (src/domain/deadline) holds a monotonic work budget and a separate finalize budget that starts when finalization begins. ProviderStartupDeadline is built on it and exposes finalize(), so a failed Ghidra startup drains launcher output under its own budget and the caller's signal instead of the expired startup signal. The six wall-clock deadline sums in src move onto Deadline; a counted guard keeps the one page-clock conversion and rejects new copies.
* refactor(process): share one finalize window across repeated beginFinalize calls
NodeHttpRequestOwner.drain() reported a failed response-source finalizer as a transport resource constraint, which reads as a budget the caller could raise. It is retained cleanup, so drain now throws a ProviderCleanupError with cleanupIncomplete and the retained resource, and the file leaves the typed-resource-refusal baseline.
* refactor(application): own the finalization precedence in runOwned
runOwned runs owned work, closes its owner and applies the documented
precedence once: a recorded failure stays primary, cancellation before
commit keeps the completed value as a partial observation, cancellation
after commit keeps the value, and unconfirmed cleanup reports
cleanup_incomplete while keeping the completed value. finishAnalysisCommand
now projects its Finalized outcome; its 31 callers are unchanged.
* fix(application): preserve finalization outcomes
* fix(application): classify finalization by the primary error and keep cancellation through recovered publication
A producer composite whose primary is a cancellation finalized as failed because the kind read only the top-level error class; it now follows primaryAnalysisError. A cancellation that arrived while a recovered value's publication failed was dropped because the signal was read before that last await; it is now attached to the publication failure as a secondary.
* fix(cli): keep the initial failure snapshot whenever close itself succeeded
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
* refactor(hopper): build Hopper cancellations with a required reason
Migrate the remaining AnalysisCancelledError constructions under
src/hopper to cancelledBy. Regex-search close aborts its workers with
OwnerCancellation.ownerClosed. HopperCleanup and HopperClient are not
touched.
* test(hopper): cover cancellation during search shutdown
* fix(hopper): name the failing fields when a bridge reply misses its contract
* fix(ci): run the package baseline when the fake Hopper bridge changes
* fix(hopper): name nested union failures and cover every native schema in the package scope
* refactor(parsers): report format failures through one ParseFailure algebra
Add ParseFailure (malformed, truncated, unsupported, limit, with format,
offset and field) and its one carrier, ParseFailureError, in the domain.
BinaryReader now names truncation and the field it read, and its native
format and resource failures are ParseFailureError subclasses.
Providers projected a format failure with their own instanceof ladder,
and some dropped the selected path from the invalid_format message.
parseFailureAnalysisError now owns that projection for the native,
Go, devicetree, V8, Windows Shortcut and Electron fuse providers.
The V8 code cache, Windows Shortcut and Electron fuse format classes
are removed in favour of the algebra.
The architecture guard counts raw Buffer and DataView reads, plain
Error throws in parser folders and plain JSON.parse of parser input
against baselines that can only shrink.
* fix(parsers): stop reading every RangeError as a format failure
Mach-O, Swift and Objective-C metadata parsers threw RangeError for a
truncated or malformed record, so their catch sites treated any
RangeError as a partial decode: a call stack overflow or a host string
limit became an "unresolved" metadata reason, and the IL2CPP Mach-O
path reported it as a malformed container.
Those parsers and the CIL method body reader now throw ParseFailureError.
hostRangeErrorKind is the one interpreter of a host RangeError (stack
overflow, host capacity, raw out-of-bounds read), and
parseFailureFromCause admits only a parse failure or a raw
out-of-bounds read as evidence about the input. Fixup stream catch-alls
rethrow host limits. The architecture guard counts the remaining direct
instanceof RangeError checks.
* fix(parsers): preserve Apple metadata failure ownership
* test(architecture): shrink parser failure baseline
* fix: preserve uncertainty for host range errors
SourceMapFormatFailure and its format/unsupported/limit/section-overlap reasons are replaced by ParseFailureError with format source-map. Limits carry the selected allowance name and maximum; a section-boundary overlap is a malformed failure on the section-boundary field. The codec reply protocol and every public error are unchanged.
* test(architecture): ratchet top-level layer direction and mutual imports
Declare a layer for every top-level src/ directory and root source file
(domain, contracts, foundation, providers, application, composition,
adapters) in scripts/lib/module-layers.mjs. verify:module-boundaries now also
builds the production import graph between those units and compares it with
a counted baseline: 45 unit pairs import a higher layer (248 imports) and 23
unit pairs import each other. A new upward pair, more imports on a recorded
pair, a new mutual import, or an undeclared unit fails; shrinkage is
reported so the baseline can be lowered.
* fix(architecture): enforce layers for isolated units
* refactor(errors): type 14 baselined resource refusals as fixed ceilings or measured exhaustion
Fixed ceilings (NTFS journal file, web-bundle worker transfer, Playwright trace parser, lipo field retention, exactly representable file sizes) now name their allowance; observed heap or result-capacity exhaustion and occupied admission declare measuredExhaustion. The typed-resource-refusal baseline drops from 24 sites in 19 files to 10 in 10.
* fix(browser): name the trace parser allowance the record actually exhausted
* test(ntfs): compare the oversized-acquisition recovery with its owning formatter
* refactor(model): report GGUF and Safetensors format failures through ParseFailure
* fix(model): report malformed model headers as invalid_format through the shared mapping
Malformed and truncated GGUF and Safetensors headers now take the shared ParseFailure mapping (invalid_request, invalid_format on path) instead of the model provider's own BinaryTargetError file_format_rejected. Unsupported forms stay unsupported_target and model allowances keep their resource-constraint recovery.
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(android): build mobile-provider cancellations with a required reason
Migrate every remaining AnalysisCancelledError construction under
src/adb, src/android, src/apktool, src/apkSignature, src/flutter,
src/il2cpp, src/dotnet and src/frida to cancelledBy and lower the guard
baseline from 671 to 608. A closed adb provider reports
OwnerCancellation.ownerClosed for later probes, and JADX and apktool
shutdown abort with that typed reason.
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
* docs: refuse literal tool counts in living prose
docs:check now refuses a count of ten or more tools in README, AGENTS,
CONTRIBUTING, docs/ (except dated releases, specs, verification and ADR
records), the authored skill and the public website. The catalog owns that
number and every hand-written copy goes stale when a tool is added. The three
current statements (240, 172 and 254 tools, all measured on earlier builds)
now refer to the catalog of the measured build instead.
* fix(docs): exclude generated pages from prose checks
* fix(docs): rerun the tool-count check when any scanned prose changes
The docs:check:built cache inputs and the CI docs lane did not cover AGENTS.md, CONTRIBUTING.md, every .agents/skills tree or website/public, so an edit there could reuse a cached pass or skip the docs job. The scanner now owns one isLivingProsePath predicate; the CI plan selects the docs lane with it, and a test binds the turbo inputs to the scanned roots.
Hopper and native dispatch metadata re-ranked FAT slices from the target's
architecture name instead of reading the admitted universalSlice. Both now
consume the admitted range and refuse when it is missing or undeclared.
Mach-O load-command codes move to one table with an architecture guard.
* refactor(rust): report cargo-auditable section failures through ParseFailure
RustAuditableFormatFailure restated the malformed/unsupported algebra and
the provider translated it by hand; container BinaryFormatFailures were
re-wrapped and lost their kind. The reader now throws ParseFailureError
(format rust-auditable), container failures propagate unchanged, and the
provider maps both through parseFailureAnalysisError. A counted guard
keeps new per-format failure classes from returning.
* test(rust): pin the container's truncated failure facts through the Rust reader
* fix(browser): type CDP command replies and parse frame trees once
CdpConnection.send is typed by method name. A command registered in
src/browser/protocol/CdpCommands.ts has its parameters typed from the
protocol table Playwright ships and its reply parsed once by its own result
schema; a mismatch rejects that command with CdpMalformedReply
(protocol_error, command, JSON pointer) without poisoning the connection.
Playwright storage sessions admit replies through the same table.
Page.getFrameTree and Page.getResourceTree are the first registered
commands. Their one parser keeps per-frame facts tolerant (malformed child
entries remain explicit omissions) and replaces the per-site readers:
observeMainFrameUrl, mainFrameUrl, walkFrameTrees, frameTreeResources,
runtimeFrameTreeSchema and the scenario storage frame schema.
A reply without a frame tree used to be retried for two seconds and
reported as target_not_allowed; it is now one protocol_error.
A guard test counts literal CDP command names without a result schema per
source file; the baseline can only shrink.
* fix(browser): consume parsed CDP facts across boundaries
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
* refactor(contracts): derive the public tool catalog from one contract-group list
toolContracts.ts and toolFamilies.ts each imported and listed the same
contract groups. toolContracts.ts now owns one ordered group object;
TOOL_CONTRACTS is its flattened values in the same catalog order, and
toolFamilies.ts reads TOOL_CONTRACT_GROUPS from it instead of re-importing
every group. The static catalog-source lint rule learns the
Object.values(groups).flat() composition so positional-contract enforcement
still discovers every group without executing modules.
* fix(lint): reject computed tool catalog groups
* feat(errors): type refusals at the producer with a total recovery
A resource refusal without authored text fell back to resource-kind advice:
a fixed parser ceiling reported as memory told the caller to add host
memory, an upstream IDA reply ceiling pointed at REA's MCP transport, and a
fixed Kuna text ceiling reported as capacity was marked retryable. An
ambiguous selector was reported as invalid input that pointed at the schema.
Add AnalysisRefusal with three variants built from facts producers already
own: fixed_ceiling (FixedAllowance, now with limit, unit and narrowing),
adjustable_budget (AnalysisSettingLimit) and ambiguous_selector (new
AnalysisInputError option). Each variant is attributed to the error's
operation and projected under details.refusal. Presentation is a total
switch over the variants, and authored text still takes precedence.
Migrate the first producers. GraphQL nesting, Playwright trace input, the
Kuna function text and the IDA upstream reply become fixed ceilings. jadx
overloads and Kuna ambiguous names become ambiguous selectors, replacing the
two Kuna-specific ambiguity texts. Seven occupied admissions declare
measuredExhaustion. The rea/typed-resource-refusal lint rule rejects new
untyped resource constraints, and the remaining 24 are counted in a baseline
that can only shrink.
* fix(errors): honor refusal recovery ownership
* refactor(parsers): report format failures through one ParseFailure algebra
Add ParseFailure (malformed, truncated, unsupported, limit, with format,
offset and field) and its one carrier, ParseFailureError, in the domain.
BinaryReader now names truncation and the field it read, and its native
format and resource failures are ParseFailureError subclasses.
Providers projected a format failure with their own instanceof ladder,
and some dropped the selected path from the invalid_format message.
parseFailureAnalysisError now owns that projection for the native,
Go, devicetree, V8, Windows Shortcut and Electron fuse providers.
The V8 code cache, Windows Shortcut and Electron fuse format classes
are removed in favour of the algebra.
The architecture guard counts raw Buffer and DataView reads, plain
Error throws in parser folders and plain JSON.parse of parser input
against baselines that can only shrink.
* fix(parsers): retain malformed range offsets
verify-real-hopper asserted complete relationship coverage for
analyze_function, but HopperProvider always declares unknown caller and
callee coverage with a reason, and compare_functions then reports the
calls dimension as unknown. The fixture oracle now checks the declared
unknown and its reason instead of demanding coverage Hopper never
claims.
Fixes#8067
Only the verifier hunk of #9496 is taken; the rest of that PR reverted
unrelated main code.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Every rea process imported and registered all 52 command registrars
(about 1,900 modules) before running any command. A one-shot command
now loads only the registrar that defines its top-level command.
- src/cli/cliCommandRegistrations.ts holds every registrar in one table,
grouped by tool family, with its module loader and its call. The
complete createCli registers the table with static imports, and the
types check that each entry matches its module.
- src/cli/cliShell.ts owns what does not depend on which commands are
registered: identity, globals, argument policy, completions and the
registration builtins. The full and lazy paths share it.
- scripts/record-cli-commands.mjs records, after tsc, which registrar
defines each top-level command, from the same compiled table. The
bundle keeps the record as an external dist module.
- cli/cliLoader.ts selects the recorded registrar when a known top-level
command runs. It loads the complete CLI for help, --schema, --llms,
completions, builtins, unknown names ("did you mean"), or a missing
record.
- Process-owned CLI resources register their closers when their module
loads (cli/cliResources.ts), so the shell no longer imports
JavaScript-analysis and guidance owners just to close them.
Measured on one pinned core (median of 5 warm runs, base main vs this
change):
- guidance: 1.95 s / 253 MB → 0.42 s / 101 MB
- list-cutter-sessions: 1.97 s → 0.49 s
- inspect-go-binary: 1.95 s → 0.95 s
- setup --dry-run: 2.40 s → 1.88 s
- analyze: 2.39 s → 1.78 s
- --help: 1.99 s → 2.04 s (complete CLI, as before)
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
- doctorCancellation measured from the signal, after the probe had
started, so a probe stopped by its own deadline could still pass. The
fake probe now records its start, and the check runs from there.
- rea/project-wait-deadline missed literal computed `timeout` keys and
spread options. It now reports both, as well as computed keys it
cannot read.
- The testing guide notes that a long-running test's expect.poll keeps
its project budget, while waitFor follows the tag's deadline.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Vitest's expect.poll and vi.waitFor stop after one second by default, a
host-speed guess that the project's deadline policy does not see. Under
hosted-CI load, kunaProjectConcurrency failed that way twice on unrelated
PRs. Another 256 waits relied on the default, and 97 passed literals
picked to fit some host.
Waits now take as long as their test may run, less the reporting reserve
that children already keep. Each Vitest project sets expect.poll's
default, and the new waitFor in tests/support/testWait.ts replaces
vi.waitFor. Fixture readiness waits (awaitAcknowledgement and the provider
process waits) default to the same deadline, and their host-speed literal
arguments are removed. One remainingTestDeadline owns the arithmetic for
both children and waits.
Ten waits whose short timeout was the real check now assert it directly
(Kuna version probe, Cutter discovery, doctor and Inspector cancellation,
apktool fixture teardown, JADX disconnect): settlement before the
production deadline that would otherwise also satisfy the wait, or a
deadline pinned beyond every test deadline.
The rea/project-wait-deadline lint rule rejects vi.waitFor and explicit
expect.poll timeouts. The testing guide and the CI tests audit skill now
document the policy.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
morluto