mirror of
https://github.com/morluto/rea.git
synced 2026-11-11 01:13:39 +00:00
35f1c3517fa8b71f27a5ee50816482028858611f
30
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Vinícius Andrade
|
dcf481c11a |
fix(cli): admit native data type selectors before opening a target (#7360)
* fix(cli): admit native data type selectors before opening a target * fix(cli): advertise the native data type selector choice * test(cli): reject invalid native data type selectors before target access * test(cli): cover native data type selector discovery * fix(cli): reject an empty native data type target before resolution inspect-native-data-type still declared its positional target as a plain string after #7956 moved its sibling local-file commands to localPathStringSchema, so an empty target passed validation and resolved to the working directory. Use the shared schema and cover the command in the empty-target admission table. * refactor(cli): share native data type selector guidance owner * test(cli): bind native data type selector checks to owning contracts |
||
|
|
4d7c6efe9a |
feat(desktop): open the seed's document at launch, and say when a seed was made for the task (#9054)
* feat(desktop): capture, draft, export and witness a task inside a build computer - start_build_capture runs REA's capture inside the computer through a small controller over computer-exec, after a user-space apt-get update; mark_build_checkpoint returns once the capture confirms the checkpoint; stop_build_capture returns the draft between seed and end. - export_build_environment exports with the requester's task inside the computer and fetches the bundle through data/get in bounded batches. - check_build_task grades a computer's data/get with REA's evaluator and, through seed, after_edit, near_miss and after_reset stages, records a witness with the action log and the screen recording; act_on_build_computer gains reset. - Capture progress lines carry window, checkpoint and refusal events; apps start in the home; a pack script builds the runtime archive; long tools send progress notifications. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): make build capture and witness steps retryable, and close the near-miss reset hole - A capture whose start answer is lost is stopped at once and kept unreleased until the stop is confirmed; a lost checkpoint answer is recovered from the capture's own log, and draft and export use the checkpoints its Evidence records; stop can be repeated to resume reading its result. - A witness can check its seed again after a failed read, and keeps its stages in a saving state until the record is written, so a failed save can be retried without reading the app again. - after_edit and near_miss count only click, drag, scroll, type and key, so a reset no longer stands in for the near-miss edit. - A .deb build keeps its package file for capture and passes its URL to export; bundle downloads write each checked file before fetching the next; an apt-get update failure reports its exit code and log tail; reset sends progress while it waits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep the Trash out of seeds, bundle folders unwritten and first frames drawn From the blind Inkscape rebuild: - Paths in ~/.local/share/Trash get a desktop_trash reason and the shared_desktop role, so a file trashed before seed is neither owned nor seeded; the export names it in a limitation. - The keep helper runs with PYTHONDONTWRITEBYTECODE=1, so starting a computer from a bundle folder no longer writes __pycache__ into it. - start_build_computer waits, bounded, until the first frame is not one colour before returning it. From review: a .deb that apt also offers exports from apt, since export passes --package-url only when the capture says the package must come from its file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound the first-frame wait's retries to the time left, with progress throughout Each retry of the drawn-first-frame wait runs under an abort that fires at the 10 s deadline, and the latest frame is returned when time runs out. connect takes the first frame itself while its progress heartbeat still runs, reporting "waiting for the desktop to draw". The wait moves to DrawnScreenshot.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): serialize each build computer's calls, keep one recording id, and separate unreadable checks from failures - One queue per computer: actions, capture steps and witness checks run one at a time, so two overlapping after_edit checks can no longer both be filed and let the witness hold without a near miss. Close cancels the running and queued calls; different computers still run concurrently. - The witness keeps one recording request id per computer, so a seed retried after a lost reply recovers the recording it started. - A check that could not read its file is undecided, not a failure, so a temporary read error can't satisfy seed, near_miss or after_reset; such a stage is refused and can be checked again. - The export's file listing is written to a file and read back in bounded batches, so a large bundle no longer overruns exec's 1 MiB output. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): treat failures on cut views as undecided, require a decided seed failure at export, and keep a close's cancellation - A presence check that misses its line, row or pointed value in a view cut short is undecided rather than failed, since the data may sit in the part left out; a witness stage can no longer be proved by such a failure. - Export counts only decided failures on the seed, and refuses a task whose every seed failure is undecided. - A step whose turn was aborted by a close or the caller returns cancelled even when its work finished, so start_build_capture no longer reports success for a computer being removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a step's saved result when a cancellation arrives during its commit Reporting cancelled for any step whose turn was aborted after its work replaced a completed export or witness save with a bare cancellation, losing what was saved and leaving the witness unreadable. Steps now return what they completed; only start_build_capture, which commits nothing, checks its turn after the post-launch screenshot and reports cancelled. Asking again for a saved witness's final check returns its record. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse a saved witness's repeated check for another folder Asking again for the check that ended a witness returned its saved record whatever directory came with it, so a caller naming another folder got success though nothing was saved there. A different folder is now refused, as an unfinished seed's retry already is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): assert the facts of cut-view and undecided outcomes, not their sentences The new cut-view, missing-value, undecided-refusal and witness tests froze whole descriptions, so a harmless rewording broke them. They now check each outcome's id, passed and undecided exactly and the facts its message must carry (file, pointer, line, row, stage) separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text - Both readers accept a DOCTYPE with only a name and an optional PUBLIC or SYSTEM identifier, record it as the view's doctype, and never fetch the DTD or expand entities beyond XML's five; an internal subset, an external entity and a parameter entity stay refused alike. - text_equals and text_contains compare the concatenated text of the element (or text node or attribute) a pointer reaches, as XPath string() does, with optional normalize_whitespace; both evaluators agree, and a text check on a truncated element is undecided. - Whitespace-only text between elements is dropped only when the element holds no other text, so text split into runs keeps its spaces. - The draft suggests text_equals for an element whose text changed. So an AbiWord .abw reads as XML, and its paragraph's text is checked whole however AbiWord splits it into <c> runs, as Writer's spans are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps - A changed value is read at both ends, so text that became a run still marks its paragraph, and the drafted text_equals moves up out of mixed content to the nearest ancestor named by an attribute, such as AbiWord's p by its xid. - Text checks accept only a text node or an attribute value; element names and doctype fields fail, in both evaluators. - isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy). - XML files are drafted with the keyed diff the archive entries use, so no suggestion reaches an element by position; the shared logic moves to appTaskDraftNamed.ts. - Text-check tests assert facts, not whole sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs' A drafted whole-text check on a paragraph hid every change inside it, so a link whose label and href both changed drafted only the paragraph's text and the new destination went unchecked. The text check now covers text and runs added or removed whole; a changed name or attribute of an element both versions hold keeps its own check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check The owner of `.../attributes/name` was taken as `.../attributes`, so a changed `name` attribute inside a paragraph with a text check was dropped again. The owner is now read by segment, attributes first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container Text typed into a run the diff lists whole was never read, so the draft kept only a presence check on the run, which wrong text also passed. Such text now marks the nearest element both ends hold, or, when none can take the check, the added element's own text. The climb also names an element by an identifier of its own (id, xml:id, xid) before a larger container, so a headline under a long layer keeps a whole-text check that survives re-split runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): expect the whole-text check where #8988's pairing test meets text checks On this branch a changed element's text is drafted as `text_equals` on the element, so the identity pairing test now expects that check, under the same `[@role=body]` key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(skills): build a computer-app environment from a request The product skill gains references/desktop-build.md, a procedure that takes Claude from a request such as "an Inkscape environment where the agent changes a poster's headline" to a witnessed bundle and a report, through start_build_computer, act_on_build_computer, the build capture tools, export_build_environment and check_build_task: questions asked once upfront, pauses only when blocked, a seed made in the app, content checks by selector, a witness with a near miss and a reset in a fresh computer, and solver runs only within a budget. setup installs the new reference; skillVersion 61. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): fold the blind Inkscape rebuild's friction into the build skill key takes an array of one chord's keys; check for a text cursor before typing in apps with single-key shortcuts; in Save As, click Documents and type only the file name; anything saved before seed, the Trash included, is part of the seed; dismiss first-run dialogs before seed; a bundle's app starts with the seed's files but need not open the document; Inkscape's window class is Inkscape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): fold the held-out AbiWord build's friction into the build skill Name the act fields and link the guide; a region screenshot becomes the latest frame; a drawn caret is not focus; confirm dialogs with Return; check the dialog's folder when the app shows only a name; an XML file the draft shows as lines was read as text, so use short line checks; and keep text checks to the value the edit types, since some apps save a reloaded document differently. Later witness stages take no directory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): state the export's seed rule, the Trash exception and draft refusals exactly The export refuses a task unless at least one check fails on the seed and every check passes at the end; a file moved to the Trash is left out of the seed, so trash a stray file rather than starting over; a null draft names its cause in draft_refusal; and a line check on a format read as text only approximates a value, so bound it and call it approximate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): teach the build skill to use DOCTYPE and whole-text checks The skill now checks text an app splits into runs whole with text_equals or text_contains, finds an AbiWord paragraph by its xid, and drops the Writer revision-id workaround. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): point text checks at the paragraph, and say what the scrub replaces From the AbiWord rebuild: point a text check at the paragraph or another element the edit keeps, never at a run a reopened document splits; how to name an unchanged element; the export replaces the host name, user@host and home path while a bare user name stays; AbiWord's entry and class. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep every text check on a cut element undecided, in both evaluators The XML reader drops text deeper than its depth limit but keeps later siblings, and an element's whole text joins both sides, so a text_contains on a cut element could match text the file never holds ("at 3" + deep "WRONG" + ":30 PM" read as "at 3:30 PM"). Any text check on an element of a cut view is now undecided again, as #9050 had it, in REA's evaluator and the exported verifier; a text node or attribute value stays decided. The text check tests assert facts rather than sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): open the seed's document at launch, and say when a seed was made for the task An exported app now opens the seed's one document at launch when its desktop entry's Exec takes files, so a solving agent starts in the document rather than on the app's start screen; a command that already names a file is kept, and several documents or an Exec without a file code keep the launch and say why. `--synthetic-seed`, which the build export passes, words the README and limitations for a seed made in the build computer instead of asking to keep the user's data local. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): count only a document the launch names, absolute or from its working directory, as already opened A settings path under the home, such as geany's --config, kept the seed's document from opening, and a relative document argument was missed and appended again. An argument now counts only when it resolves, from the captured working directory, to a file the capture gave the document role. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): check the seed and launch wording against their formatters, and the facts on their own The tests froze the README's and limitations' sentences, so a harmless rewrite broke them. The wording now comes from exported formatters (`seedWording`, `seedLimitation`, `launchDocumentNote`, `NO_LAUNCH_DOCUMENT`), the tests compare against those, and check the facts separately: which document opens, the respelled path in the command, the README naming it, `--synthetic-seed` and the Evidence's `synthetic_seed`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(desktop): plan the export's seeds and launch in their own module The merged export module passed the file and function size limits; the seed digests and the launch command now come from `DesktopExportLaunch.ts`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a reset applied when the screenshot asked after it fails Once data/reset and the ready wait succeed, act_on_build_computer's reset is applied in the action log and returns success; a screenshot asked of it that is then refused or throws is named in the result's screenshot_error, with no frame, so the next after_reset stage is not refused. Cancellation still propagates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings A review found two gaps. - A paragraph's whole-text check covered every element added or removed inside it, including ones holding no text: an image frame, a line break. A solver who typed the text but never inserted the image passed. Such an element now keeps its own presence or absence check. - The Python reader kept a DOCTYPE system literal's CRLF where TypeScript normalizes it to LF. Both now report LF. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): wait out long build commands, fail a reset that restores nothing, and tie the witness to its bundle A review found five gaps. - Commands in the computer answer only when they end, but fetch stops waiting for headers after 300 s. So a slow export, draft or start always failed. A command with its own deadline now waits on node:http, bounded by that deadline. - after_reset held whenever some check failed, so a reset that changed nothing passed on the near-miss state. Each check must now come out as it did at the seed. - A failed or partial apt-get update left lists that looked complete, so a second start skipped the update. The update is now recorded only when it succeeds, and rerun otherwise. - A witness on a bundle computer graded whatever task it was given. Its seed stage now refuses a task whose steps or checks differ from the bundle's. - A task too large for one command argument (96 KiB) is refused before the export runs, instead of failing with E2BIG in the computer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): advertise a checkpoint-name pattern that compiles in every JS regex mode main's advertised-pattern test compiles every input schema pattern in v mode, which refuses an unescaped hyphen in a character class. The checkpoint name's hyphen is now escaped, and it means the same in u mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): import textSyntaxFormat once in the state format tests main's mixed-case JSON suffix fix and this branch both added the import, and the merge kept both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a completed reset, an unread seed, and a failed apt update A cancel after data/reset no longer drops the restore from the action log, so a near miss cannot treat the restored seed as an edit. An unreadable seed check that later passes leaves after_reset undecided instead of failing the witness. apt-get update is kept only when Error-Mode reports success and a package list was fetched. The controller reply schema lives with the controller, and capture progress lines are read by their domain parser. * fix(desktop): keep a whitespace-only run under the paragraph text check A run whose only text is whitespace is still text the paragraph check reads. It no longer gets its own presence check, which a later save of the same words without that run would fail. Images and breaks, whose text is empty, still keep their own checks. * fix(desktop): keep an unread reset and a cut text check undecided after_reset stays undecided when any check was not read, even if another check still fails and the unread result's boolean matches the seed. A text check for a child past a truncated view is undecided in both evaluators. A reset whose reply is lost blocks a near miss until a later input or a reset whose reply arrives. * fix(desktop): retry a witness recording and a published record's cleanup A recording that fails to end or download is not written into the witness folder, and a manifest already received is fetched again without ending the recording twice. A folder that is published while its handles fail to close keeps that record and retries the same cleanup instead of writing the folder again. * fix(desktop): keep a published witness error and tag an app data refusal A second failure to close a published witness returns the original error, so its record and cleanup lease stay bound. A reset the app itself refuses is an AppDataRefusal; only a reply that is not that refusal stays unsettled. A missing child of a cut view is undecided with the same description in both evaluators, and the shared cases cover it. * fix(desktop): align a cut view's missing text with the Python check A missing child of a truncated view is undecided for the same sentence in both evaluators, including the pointer the view does not contain. * fix(desktop): keep one published witness cleanup across retries A published record and its bound cleanup error stay together. A later close failure returns that error, and the unused path that built a fresh adapter error is gone. * fix(desktop): keep a bundle task read inside the witness result A cancelled, refused, or failed read of the bundle's task files returns the witness's Result, including a cleanup lease when a handle would not close. * fix(desktop): check build runtime export capability * fix(desktop): provide complete runtime repack command * fix(desktop): retain runtime probe failures * fix(desktop): recognize captured file URL documents * fix(desktop): render captured file URLs at launch * fix(desktop): isolate launcher URL encoding * test(desktop): move launch execution to boundary suite * style: fix desktop launch test formatting * style: format native command path schema --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morluto
|
d9c9e6ea67 | fix(cli): retain completed Evidence through finalization failures (#9469) | ||
|
morluto
|
25d3c7237f | fix(paths): enforce selected path contracts at admission (#9465) | ||
|
morlutoandCursor Agent
|
b81da90354 |
feat(native): page retained procedure references (#8588)
* feat(native): page retained feature traces * fix(snapshot): retain linked source evidence for replay * test(snapshot): verify linked foreign evidence stays scoped * feat(native): page retained procedure references * docs(mcp): clarify imported residual questions * docs(mcp): guide trace reference classification * fix(cli): report result sources when Evidence publication fails A trace keeps linked sources on the result. Use those records for the undelivered source closure as well as the bundle, so a refused output does not report them as not captured. * ci: rerun pull request checks The merge of origin/main did not start the CI workflow for this head. * fix(native): document shared procedure endpoints and the required selector Describe kind shared and items.endpoints instead of inline procedure copies. State that procedure-references requires a positional selector or --procedure. * fix(native): count procedure-reference endpoints before keeping a row Include the shared endpoint table in the page budget, with JSON punctuation, and store a new procedure only when its row is accepted. * fix(native): measure a procedure endpoint once before its comparison key Size the candidate before building one canonical identity, and reuse that key for the selected-procedure and shared-endpoint checks. * fix(native): reject an oversized procedure endpoint before canonicalizing it When the JSON size already exceeds every stored identity, skip the canonical string and keep the row out of the page. * fix(native): describe procedure-reference direction and coverage Avoid execution wording in the tool description, and give the CLI direction option the help text the catalog requires. * fix(native): compare endpoint size with UTF-8 identity length Keep one running maximum of stored identity bytes. A multibyte selected procedure is recognized when its JSON no longer fits the page. * test(cli): count procedure-references as a dedicated command The MCP tool has a CLI command, so it is no longer an MCP-only exception. * test(native): catch the string-length endpoint comparison Use a 200,000-character multibyte selected procedure and a shorter ASCII endpoint so the old JavaScript length check drops the selected row. * ci: rerun after the binary-layout toolchain timeout The required check failed because the toolchain install exceeded 15 minutes. The same job completed on the previous head, and this commit does not change the procedure-reference behavior. * test: stabilize capture decoder exhaustion coverage --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
887b99888e |
fix(ghidra)!: distinguish skipped overlays in byte search (#8608)
* fix(ghidra)!: distinguish skipped overlays in byte search BREAKING CHANGE: Byte search results require skipped_overlays; loaded overlays no longer appear in skipped_not_loaded. The Ghidra profile changes so prior snapshots are not replayed. * fix(cli): explain overlay byte search scope * test(ghidra): exercise overlay search cursor handoff * test(ghidra): avoid freezing byte search help wording * test(ghidra): classify search start as an address bound * docs(ghidra): match the raw lane's overlay coverage The raw Ghidra lane checks a manually created overlay block through MCP. Say that, and do not claim an overlapping-load ELF, CLI search, or snapshot cursor handoff. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
015a02d57b |
feat(ghidra)!: identify containing code and data (#8777)
* feat(ghidra)!: identify containing listed instructions * fix(ghidra): validate instruction containment status * fix(ghidra): validate containment coordinates * feat(ghidra): identify containing defined data * test(ghidra): correct snapshot and containment controls * docs(native): distinguish object and dynamic type sizes * docs(cli): retain incoming reference guidance * fix(mcp): clarify data object address guidance * test(ghidra): preserve defined data in reference fixtures |
||
|
morlutoandCursor Agent
|
6ca4e1368c |
fix(cli): guide analysts to typed incoming references (#8514)
Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
4bb53000a3 |
fix(ghidra): clarify function annotation selectors (#8584)
* fix(ghidra): clarify function annotation selectors * test(ghidra): compare catalog guidance with its contract --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
99db80a13e | fix(cli): reject non-decimal integer tokens on every numeric option (#9178) | ||
|
morluto
|
78d7bf3ea0 |
docs(native): clarify memory and file byte sources (#8829)
* docs(native): clarify memory and file byte sources * docs(native): qualify Ghidra fixup coverage |
||
|
Ha1baraA1
|
bd7002b441 |
fix(cli): export source Evidence for native value traces (#8297)
* fix(cli): export source Evidence for native value traces * fix(cli): export source Evidence for native value traces * fix(cli): preserve trace completeness in summaries |
||
|
RRFZ
|
6db024dc96 |
fix(cli): reject empty native and managed targets before resolution (#7956)
Local file commands in the core binary, native, managed and native-tool CLI groups declared their positional target as a plain string. An empty argument therefore reached path admission, where it resolved to the working directory, as docs/cli.md says it never should. Declare those targets with the shared nonempty, NUL-free local path schema already used by analyze, so the CLI rejects them as a VALIDATION_ERROR naming the field before any analysis runner is called. Explicit "." is unchanged. Fixes #7436 Fixes #7404 |
||
|
morluto
|
76c7698ac9 | fix(cli)!: preserve native value input diagnostics (#7889) | ||
|
gensokyo-dev
|
a0a1962e06 | fix(cli): validate byte queries before opening targets (#7723) | ||
|
morluto
|
329325049c | refactor(cli): retain typed analysis outcomes through delivery | ||
|
gensokyo-dev
|
f69c52a1cf |
feat(native): page retained load-image observations (#7134)
Add optional native load-image summary delivery and retained selected-row pages through shared CLI/MCP analysis views. Preserve source verification, provenance, unavailable collections, exact row identity and opt-in byte/check payloads. Preserve direct caller paths during shared CLI summary publication and cover raw/DOL projection contracts through the actual SDK. Real Ghidra ELF CLI/MCP captures, retained and file-backed pages, focused regressions and static checks passed; the PR records existing main schema failures and the JavaScript resource-recovery CI uncertainty. |
||
|
|
9dde3fd6a4 |
fix(cli): advertise required CLI selector choices (#6759)
* fix(artifacts): retain caller selection and applicable publication recovery * fix(artifacts): retain DMG producer failures and bound integrity recovery claims * fix(apk): classify malformed supported Zip64 records as input failures * fix(browser): compare script and tool facts without metadata identity churn * fix(environment): retain path segments counters and parent diagnostics * fix(discovery): retain Frida optional provider failure dispatch * test(native): share Swift context in vtable fixture admission * fix(native): narrow capability refusal before retaining its reason * fix(javascript): retain private receiver and iterative disposal effects * fix(native): preserve negative Mach-O admission identity * fix(javascript): bind Next page admission to source context * fix: preserve process filesystem scope and admission failures * fix(evidence): reject runtime locations for managed static facts * fix(hopper): bind ordinary executable opens to selected bytes * fix(browser): admit legacy capture uncertainty at retained input boundaries * fix(unknowns): distinguish rejected creation from committed mutation delivery * fix(evidence): preserve authentication failures and diagnose prior commitments * fix(cli): preserve explicit Evidence record pairing in bundle comparison * fix(artifacts): publish addressable inspection sources through both adapters * docs(evidence): define authentication and committed delivery recovery * fix(javascript): own reference roles and invocation result identities * fix(hopper): pass private X authority cookie through stdin * fix(ghidra): preserve catalog and metadata admission failures * fix(jeb): retain selected inputs and completed primary replies * fix(native): preserve literal environment map members * test: retain direct hash cleanup retainer contract * test: distinguish corrected port normalization commitment * fix: recheck attached worker policy after final artifacts * fix(javascript): share iteration and equality invocation facts * fix(artifacts): preserve typed resource limit diagnoses * fix(javascript): preserve semantic query identity and source coverage * docs(readme): align translated setup and analysis facts * fix(cli): reject surplus positional arguments before execution * fix(kuna): retain setting-specific doctor recovery * fix(setup): preserve semantic configuration refusal during uninstall * fix(setup): retain publication operation failures and recovery facts * fix(setup): distinguish Hopper inspection and archive staging failures * docs(managed): distinguish oracle conformance from host verification * docs(skill): keep one setup prerequisite policy * fix(firmware): preserve admission and extraction coverage outcomes * fix(contracts): preserve safe defaults and client literal guidance * fix(javascript): retain worker storage and projection failures * fix(evidence): preserve valid output paths near filesystem pathname limits * fix(cli): accept named native API selectors beginning with a dash * fix(artifacts): retain DMG carrier observations when child traversal is unavailable * fix(artifacts): retain dylib enumeration readers through failed cleanup * fix(browser): resolve empty storage-world origins from exact frame evidence * fix(browser): retain unknown popup storage initialization coverage * test(reconstruction): isolate derived surface ownership in fixtures * test(filesystem): probe actual permission denial before host assertions * test(managed): assert large issue retention without full-array diffs * fix(javascript): preserve source facts across graph projections * fix(javascript): preserve copied values and export publication lifetimes * fix(javascript): preserve per-field publication and provenance coverage * fix(javascript): retain initialized class self binding at body reads * fix(artifacts): retain permission omissions through JavaScript lookups * test(graph): narrow summary owner and complete PE fixture facts * test(javascript): supply source graph to native handoff checks * fix(sourcemaps): bind cleanup status to remaining codec owners * fix(browser): retain excluded source-map declaration coverage * test(javascript): preserve exact empty property keys in declarations * fix(browser): keep code absence unknown without worker inventory * fix(browser): preserve WebMCP optional fields and replay coverage gaps * fix(browser): publish executable examples with truthful capture coverage * fix(browser): preserve observed document invalidation and scope recovery * fix(native): share exact-name xref ambiguity resolution * fix(hopper): own bookmark API capability checks * fix(native): preserve procedure selector coordinate intent * test(discovery): select the declared GDB console contract * fix(ghidra): bind session refusal to retained cleanup owner * fix(apple): retain selected dylib identity after path removal * fix(apple): preserve asset failures and authored resource coverage * fix(apple): retain binary UID identity through archive projection * fix: retain completed historical replies through finalization * fix: retain unresolved browser secret declarations as input errors * test(browser): resolve network fixture secrets through typed input contract * fix(environment): distinguish destination refusal and write access failures * fix(artifacts): preserve exact ZIP and DMG caller cancellation reasons * fix(artifacts): require regular source-map target occurrences * fix(reference): separate local filesystem diagnostics from graph commitments * fix(setup): retain proven PATH aliases in installed registrations * test(package): join owned updater after registry fixture failure * fix(javascript): preserve recovery acquisition and cancellation failures * fix(session): retain cleanup blockers and snapshot request identity * fix(evidence): preserve format-owned JSON recovery diagnostics * test(evidence): cover BOM recovery across bundle commands * fix(tracing): retain caller reasons at traversal checkpoints * fix(inventory): require released cleanup before capability fallback * fix(hopper): drain retained publishers after current close failure * fix(native): preserve unknown Swift extension contexts * fix(apple): qualify unexamined nib content coverage * fix(frida): preserve session refusal and close execution effects * fix(rizin): retain cancellation and recover cleanup correlation * fix: retain Electron file admission facts across adapters * fix: preserve selected Electron display authorization * fix(javascript): retain unavailable HTML reference scopes * fix(javascript): preserve capture timing and detached receiver authority * fix(ida): preserve producer failure and caller abort outcomes * fix(cli): retain nested facts in Markdown tables * fix(cli): present argument guidance without validator cause dumps * docs(setup): define optional native update verification limits * docs(clients): distinguish discovery and schema recovery boundaries * docs(setup): explain npm workspace launcher failures * fix(verification): bind Copilot schema profile to observed inputs * fix(javascript): scope Next package admission by container identity * fix(apple): align asset allowance and category fixture types * fix(protocols): honor runtime queue and Frida identity types * test: parse Electron listing Evidence before comparison * fix(evidence): omit absent format recovery metadata * fix(contracts): validate historical source examples as exact JSON values * fix(javascript): consume per-field CommonJS publication facts * fix(gdb): correlate raw-output completion and retain read-only TTY proof * fix(native): retain completed LLDB facts across output-close cancellation * fix(hopper): retain failed private-display probe cleanup authority * style(lifecycle): format traversal and fallback edits * fix(apple): own ordered nib collections and registry parentage * fix(process): attribute trace omissions without changing shared successors * fix(cli): share builtin argument ownership with MCP routing * fix(cli): count emitted documents and normalize token windows * fix(inspector): retain captures through authorization cleanup failures * fix(artifacts): retain declared ASAR companion occurrence facts * fix(javascript): separate endpoint syntax correspondence from target identity * fix: distinguish native process exit from sampling failure * fix(javascript): retain selected-root access and filesystem failure facts * fix(browser): retain truthful cleanup facts and document request ownership * fix(native): share exact Objective-C class symbol interpretation * fix(go): retain completed artifact facts through finalization * fix(native): preserve seed analysis failures in value traces * fix(native): classify observed dSYM inspection refusal * test(apple): assert observed collection edge contract * fix(javascript): retain primary interruption through worker cleanup * fix(cutter): retain completion-read failures during cleanup retry * fix(cli): validate output windows and finish pending writes * fix(mcp): require absolute JavaScript application inputs * fix(capabilities): report missing navigation targets * fix(cli): support system Bash completion registration * fix(cli): retain narrowed token-count format handling * test(ida): preserve exact optional resource method shape * test(javascript): retain valid unknown endpoint coverage shape * fix(ghidra): try keg JDKs after failed PATH launchers * fix(browser): retain capacity refusal through terminal progress * fix(reference): require exact optional JSON diagnostics at the source schema * fix(apple): retain reader outcomes and cleanup ownership * fix(elf): qualify exports without dynamic symbol declarations * fix(mips): retain unexamined RELR declaration coverage * fix(metadata): preserve canonical PowerPC subject identity * fix(native): preserve LLDB discovery failure classifications * fix(native): report absent launch process before cleanup classification * fix(rizin): preserve primary outcomes across final cleanup * fix(browser): preserve admission failures and retain policy transport cleanup * fix(objdump): preserve input issues and provider launch failures * test(apple): attribute omitted edges to their node capacity limit * chore(metadata): synchronize packaged skill version * fix(cli): consume canonical output validation state * fix(views): preserve owning layout field diagnostics * test(pyinstaller): distinguish path and metadata allowance failures * fix(native): compose the selected command cause once * fix(setup): require HTTPS throughout Hopper download redirects * fix(ghidra): narrow fallback probe failures before projection * fix(native): require observed symbol origin for named identity * fix(javascript): retain unavailable source processing scopes * fix(cli): share declared output-error redaction * docs(windows): explain MCP registration launcher limits * fix(session): preserve binding commitments during restoration * fix(environment): retain primary facts through server cleanup failure * fix(pe): distinguish unsupported overlapping header layouts * fix(cli): keep positional admission placeholders omittable * test(cli): expose JavaScript progress workflow failure output * test(browser): match retained subframe limitations structurally * fix(javascript): preserve capture and property-key effect ownership * fix(ghidra): attribute import policy conflicts to settings * fix(native): validate Mach-O command framing before admission * docs(mcp): state plist inspection session prerequisite * fix(electron): separate script frame admission from declared source labels * test(environment): read asynchronous owner observations through contracts * test(javascript): distinguish resolver URLs from existing module targets * fix(ghidra): retain neutral recovery for observed SIGKILL * fix(hopper): preserve unknown relationship completeness * docs(native): clarify Darwin runtime breakpoint names * fix(browser): preserve unknown script ownership through reconciliation * fix(electron): keep optional provenance fields within JSON evidence values * fix(native): retain Mach-O architecture discriminant narrowing * test: give oversized registration groups semantic owners * test: group boundary registration by observed behavior * fix: normalize retained terminal observations with sampled identities * fix: identify missing Electron lineage ownership markers * fix(ida): retain registration constraints and identity refusal guidance * fix(kuna): retain published exports through staging cleanup failures * fix(nativeaot): charge only examined candidate table entries * docs: clarify batch decompilation retention limits * fix(javascript): distinguish deferred bootstrap installer writes * fix(native)!: preserve UI scalar facts and selection failures BREAKING CHANGE: Accessibility node value can also be a JSON number or boolean. Strings and null retain their prior meaning. * fix(javascript): retain activation order for captured scope exits * test(pyinstaller): use an absolute drive path for refusal coverage * fix(javascript): preserve route selection owners and uncertainty * fix(javascript): prove native URL constructor paths * refactor(tests): separate fixtures and registration groups * test(native): distinguish qualified symbol identity controls * fix(ida): preserve busy details across timeout attribution * fix(cli): unify builtin and global completion scope * test(ghidra): group exit-signal evidence controls * fix: retain narrowed terminal observation values * fix(cli): bind completion input to public registry type * fix(flutter): qualify unsupported unified snapshot profiles * test(native): bind origin comparison to containing entries * fix(cli): remove completion markers on system Bash * test(ida): preserve physical workspace traversal controls * fix(native): retain unknown UI executable identity * fix(native): unify LLDB discovery preparation failures * fix(evidence): preserve primary semantics during pending cleanup * fix(evidence): retain owner finalization reports across cleanup envelopes * test(browser): inspect provenance in owned graph observations * test(flutter): assert canonical unsupported profile error code * fix(javascript): capture primitive return values at evaluation * fix(mcp): own cancellation and raw input throughout startup * test(ghidra): construct exact import policy targets * fix(gdb): preserve configured executable launch recovery * test(ghidra): own fixed import target fixtures * docs(readme): align localized guide link occurrences * test(evidence): retain structured input issues through cleanup owners * test(mcp): await observed EOF before releasing startup * fix(electron): retain bounded source frame claims * fix(elf): validate declared file extents before provider admission * fix(elf): align metadata and admission fixture error types * test(wasm): place parsed interface comparison at provider boundary * test(ida): place capability composition at provider boundary * test(browser): place PNG contract execution at provider boundary * perf(test): share SDK catalog compilation across deferred clients * fix(cli): trim repeated selector discovery guidance * revert(test): remove unproven SDK compiler sharing This reverts commit 56eca648d. The equivalent completed two-client measurement increased elapsed and CPU time, so compiler sharing has not established a benefit. * refactor(managed): retain decoded metadata token facts * test(managed): scope cleanup failures to snapshot reads * test(cli): bound selector rejection cases by command * test(mips): distinguish damaged ELF admission from partial ABI evidence * test(reconstruction): declare authored function symbol identity * test(rizin): register terminal admission at provider boundary * test(process): align root admission fixture with observer allocation ownership * test(mips): project inspected ABI facts without undefined overrides * refactor(browser): remove obsolete web script reconciliation * refactor(javascript): remove obsolete in-process projection runner * refactor(managed): retain TypeDef row ownership through projections * test(process): assert canonical admission failure through cleanup envelopes * fix(managed): select types from retained definition records --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com> |
||
|
morluto
|
4990a0b9f1 | fix(cli): accept named native API selectors beginning with a dash | ||
|
morluto
|
44a4c1ba87 | refactor(native): centralize procedure and metadata input contracts | ||
|
Kaoru0822andClaude Opus 5.5
|
3637205622 |
feat(native): let callers raise the Apple dispatch metadata input budget (#6233)
* feat(native): let callers raise the Apple dispatch metadata input budget inspect_native_dispatch_metadata refused any Mach-O over a fixed 64 MiB before decoding, and its recovery said there was no override. Most large macOS binaries exceed it. max_input_bytes (CLI --max-input-bytes) now selects the budget, default 64 MiB and at most 1 GiB, through the shared input contract, the enhanced workflow and the native provider. Results record input_admission with the effective budget, its source and the retained bytes. A refusal names the observed size, the budget and its source, and the budget to select or, past 1 GiB, a deep analysis provider. Fixes #3917 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(cli): describe --max-input-bytes in inspect-native-dispatch-metadata help Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(native): cover max_input_bytes forwarding through CLI and MCP Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
morluto
|
d77bc0e8a0 | refactor(cli): share analysis snapshot option contract | ||
|
|
2a78763e20 |
feat(native): search analyzed memory for masked byte patterns (#2341)
* feat(native): search analyzed memory for masked byte patterns The diff adds search_bytes to the CLI, the shared MCP contract, Ghidra inventory, and the headless bridge, and advertises the same operation on Hopper as unavailable until that provider is verified. Patterns are hexadecimal byte pairs with optional ?? wildcards and an optional equal-length bit mask; the TypeScript boundary and the bridge both require a nonempty pattern, equal lengths, and at least one constrained bit. Ghidra walks initialized blocks in address order within inclusive bounds, keeps overlapping matches inside a single block, and returns each hit with its segment, unique source file offset, and containing procedure, continuing through a cursor bound to the target, profile, pattern, mask, and bounds. Each page reports the inclusive ranges examined and the skipped uninitialized blocks; cancellation returns a typed error and discards the active Ghidra database. address_to_file_offset now uses the same unique-offset helper, which rejects a mapping that is missing, ambiguous, or larger than a safe integer. * fix(native): limit unbounded byte search to loaded memory Without start or end, search_bytes walked every Ghidra block, including non-loaded file parts such as .symtab and overlay blocks, which the docs call out of scope. Unbounded searches now skip those blocks and list them in searched.skipped_not_loaded; explicit bounds in their address space still search them. Document that a match must end at or before end. * fix(native): preserve implicit address spaces in range consumers * fix(native): reject present malformed byte search state --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
Matt Van Hornandmorluto
|
7c207c7951 |
feat(native): admit raw binaries with caller-supplied architecture and entry (#1868)
* feat(native): admit raw binaries with caller-supplied architecture and entry * fix(native): honor raw-binary preparation and entry identity * fix(ghidra): stream raw snapshot attestation with cancellation * fix(native): preserve and validate raw lifecycle entries --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morlutoandFazmin
|
8b4c96e6c6 |
fix(cli): preserve native option descriptions in help
Keep the optional address description visible to incur and describe the actual bundle plist default and absolute-path support. Extend the existing command help sweep instead of traversing the inventory a second time. Refs: #1418 Co-authored-by: Fazmin <fazmin.nizam@gmail.com> |
||
|
Kaoru0822andClaude Opus 5.5
|
498cec042a |
fix(cli): stop advertising multi-letter single-dash option aliases (#1395)
Incur's `alias` map registers one-letter short flags and already accepts kebab-case spellings of camelCase options. Twenty options registered their kebab-case long name as an "alias", so help and completions advertised flags such as `-case-sensitive` and `-relative-path` that the parser reads as stacked short flags and rejects with "Unknown flag: -c". Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
morluto
|
ad59531a96 | refactor: remove forwarding exports and redundant aliases | ||
|
morluto
|
63bf91405c |
refactor!: enforce canonical evidence and provider boundaries
Deliver complete Evidence directly through MCP with required nullable analysis profiles and immutable per-server delivery settings. Bind selected environments at construction and require typed cleanup outcomes with retained retry ownership. Remove test-only routing, duplicate session and snapshot metadata, producer-field repairs, and ambiguous provider arguments. Separate artifact byte identity from occurrence classification and retain typed source-map and partial native facts across CLI, MCP, and verifier consumers. BREAKING CHANGE: obsolete Evidence envelopes, session aliases, incomplete snapshots, and missing normalized producer facts are no longer accepted. |
||
|
Ysopwnable
|
33d4761cc7 | refactor(binary): move production composition outside application workflows (#965) | ||
|
morlutoandCursor Agent
|
8b9940a7b5 |
refactor(cli): split core analysis command registrar (#858)
Extract binary overview/procedure and native load-image/annotation registrars so coreAnalysisCommands stays a thin wiring entry point. Co-authored-by: Cursor Agent <cursoragent@cursor.com> |