Commit Graph
1372 Commits
Author SHA1 Message Date
morluto 3910bedae8 fix(artifacts): always verify archived checksums; route link CRCs via policy 2026-10-08 16:38:53 +08:00
morluto 949347a148 fix(artifacts): extract nested PKG as containers; fatal symlink decoding 2026-10-08 16:23:58 +08:00
morluto da18453d4d fix(artifacts): forward archived failures, align CRC recovery, fatal TOC decoding 2026-10-08 16:19:24 +08:00
morluto b196c5ac8f fix(artifacts): traverse nested PKG on extract, honor TOC header alg, fatal cpio names 2026-10-08 16:10:20 +08:00
morluto ef0bf91de9 fix(artifacts): tear down xar source chain to avoid post-close reads 2026-10-08 16:01:54 +08:00
morluto 300682d4ba chore: merge main into feat/pkg-inventory 2026-10-08 15:50:09 +08:00
morluto 15b42b5825 fix(artifacts): preserve evidence on stream failures and bound cpio output 2026-10-08 15:47:58 +08:00
morluto 116d722339 fix(artifacts): harden pkg readers for hostile packages and integrity policy 2026-10-08 15:33:35 +08:00
Ysopwnable 7af7bc88ce feat(evm): inspect offline bytecode interfaces through EVMole (#1051)
* feat(evm): inspect offline bytecode interfaces through evmole

* fix(evm): distinguish unsupported bytecode targets

* style(evm): format verifier string-prefix checks
2026-10-08 15:32:05 +08:00
kimtth c5d165bd03 docs: improve Korean wording and particles (#1047) 2026-10-08 15:10:28 +08:00
Kaoru0822 78d594cacd Merge pull request #927 from morluto/feat/dylib-resolution
feat(artifacts): trace Mach-O dylib resolution in bundles
2026-10-07 23:52:42 -07:00
Kaoru0822andClaude Opus 5.5 3362dfa31e chore: merge main into feat/dylib-resolution
main now carries #1037 (skill version 30, reworded native binary row):
- README_ja/ar/ko/zh: take main's tables and count
  trace_dylib_resolution in the artifact graph row (5 -> 6).
- Skill: move to version 31.
- Regenerate the product catalog, conformance manifest, skill digest and
  package metadata (137 tools).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 06:31:43 +00:00
Kaoru0822andClaude Opus 5.5 31a642f73d chore: merge main into feat/pkg-inventory
main now carries #1037 at skill version 30, so this branch moves to 31.
Regenerate the product catalog, conformance manifest, skill digest and
package metadata on top of it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 06:30:05 +00:00
Kaoru0822andClaude Opus 5.5 6fa6300987 chore: merge main into feat/dylib-resolution
main now carries #964 (skill version 29, macOS native row 7 -> 8):
- README_ja/ar/ko/zh: take main's tables and count
  trace_dylib_resolution in the artifact graph row (5 -> 6).
- Skill: move to version 30.
- Regenerate the product catalog, conformance manifest, skill digest and
  package metadata (136 tools).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 06:23:44 +00:00
Ysopwnable 4fc6565b0f feat(native): inspect offline ELF layout through pwntools (#1037)
* feat(native): inspect offline ELF layout through pwntools

* fix(build): prepare offline ELF verification on clean runners

* fix(native): preserve snapshot acquisition cancellation

* fix(native): handle sectionless ELF and retain decoder diagnostics

* test(native): verify malformed symbol table entry sizes

* fix(native): respect inherited limits and unused segment fields

* fix(native): preserve packed relocations and decoder launch constraints

* fix(native): validate symbol spans and preserve resource failures

* fix(native): preserve diagnostic completeness and memory failures

* fix(native): guard bridge imports against allocation failures

* fix(native): validate relocation symbol and section references

* fix(native): retain diagnostics through compounded cleanup failures

* fix(native): preserve unresolved relocation section references

* fix(native): bound linkage evidence and preserve CPU signal diagnostics

* fix(native): preserve file-size resource failure evidence

* fix(native): retain opaque linkage names and late cancellation output

* test(native): make CPU-limit fixture robust across runners

* fix(native): verify resource failure branches before interpreting exits

* fix(native): validate declared ELF string references

* fix(native): validate section-name table before decoding

* fix(native): enforce canonical ELF name-table escapes
2026-10-08 14:22:08 +08:00
Kaoru0822andClaude Opus 5.5 5389b233b8 chore: merge main into feat/pkg-inventory
main now carries #964 at skill version 29, so this branch moves to 30.
Regenerate the product catalog, conformance manifest, skill digest and
package metadata on top of it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 06:21:54 +00:00
Rudy Mizrahi CelekliandYsopwnable 8d5c88f17c fix(javascript): resolve module URLs and reject invalid exports targets (#1031)
Resolve module URL paths once and reject invalid root package exports targets before normalization. Preserve actionable graph diagnostics and array selection behavior.

Fixes #1040.

Co-authored-by: Rudy Mizrahi Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: Ysopwnable <161784452+N0zoM1z0@users.noreply.github.com>
2026-10-08 14:00:34 +08:00
Kaoru0822 1d13cef5f4 Merge pull request #964 from morluto/feat/native-call-observation
feat(native): observe function and Objective-C method calls under LLDB
2026-10-07 22:57:02 -07:00
Rudy Mizrahi CelekliandN0zoM1z0 1154f2f03c fix(javascript): reconstruct HTML script loads accurately (#1042)
* fix: parse HTML script references with HTML semantics

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>

* test(javascript): cover exact HTML script resource identity

---------

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 13:24:24 +08:00
Kaoru0822andClaude Opus 5.5 2a7dcb77c1 chore: merge main into feat/native-call-observation
Resolve conflicts against main:
- package.json: ship both the LLDB tracer bridge and main's process run
  token reader sources.
- README.md: take main's simplified English README, which no longer has
  the tool-family table.
- README_ja.md: take main's reworded table and count
  observe_native_calls in the macOS native row (7 -> 8).
- Skill: the references gain the observe_native_calls paragraph, so the
  version moves to 29 (main already uses 28).
- Regenerate the product catalog, conformance manifest, skill digest and
  package metadata (135 tools). The MCP tool catalog is now built rather
  than committed (#997), so it is removed here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 04:58:36 +00:00
Kaoru0822andClaude Opus 5.5 79e686f6a2 chore: merge main into feat/pkg-inventory
Resolve conflicts against main:
- Inventory moved to src/artifacts/inventory (#1032); point the xar and
  cpio reader imports at their new relative paths.
- README.md: take main's simplified English README, which no longer
  lists individual package formats. PKG coverage stays documented in
  the skill reference and docs/testing.md.
- Skill: the references gain the PKG paragraph, so the version moves to
  29 (main already uses 28).
- Regenerate the product catalog, conformance manifest, skill digest and
  package metadata. The MCP tool catalog is now built rather than
  committed (#997), so it is removed here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 04:49:54 +00:00
Kaoru0822andClaude Opus 5.5 5acdb9dc6f chore: merge main into feat/dylib-resolution
Resolve conflicts against main:
- README.md: take main's simplified English README, which no longer has
  the tool-family table.
- README_ja.md: take main's reworded table and count
  trace_dylib_resolution in the artifact graph row (5 -> 6).
- Skill: the references gain the trace_dylib_resolution paragraph, so
  the version moves to 29 (main already uses 28).
- Regenerate the product catalog, conformance manifest, skill digest and
  package metadata (135 tools). The MCP tool catalog is now built rather
  than committed (#997), so it is removed here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-08 04:45:50 +00:00
AlexandN0zoM1z0 53409ab196 fix(javascript): resolve root package exports arrays (#1046)
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 12:45:21 +08:00
Alex 03424ae91e fix(javascript): recognize digits in artifact URI schemes (#1045) 2026-10-08 12:28:34 +08:00
6b55de017b fix(mcp): bound capture comparison input schema depth (#1005)
* fix(mcp): advertise JSON values without recursive schemas

`z.json()` projects a self-referential `$defs/__schema0` entry. Twenty
tool input schemas and 123 output schemas carried it, and clients or
model APIs that reject recursive JSON Schemas refuse the whole tool
list. Every JSON value satisfies `{}`, so the shared JSON value schema
now advertises that. Runtime parsing still admits only JSON values.

Refs #919

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(mcp): keep advertised input schemas within model function-calling limits

Some model providers reject the whole tool list when any input schema
contains a recursive $ref or nests deeper than 10 levels (fixes #919).
Sanitize the advertised wire projection: break cyclic $refs, bound nesting
depth, and drop unreachable $defs. Canonical Zod contracts are untouched.

---------

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: sx4im <sx4im@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 12:26:00 +08:00
7425f70fd0 fix(mcp): advertise JSON values without recursive schemas (#995)
`z.json()` projects a self-referential `$defs/__schema0` entry. Twenty
tool input schemas and 123 output schemas carried it, and clients or
model APIs that reject recursive JSON Schemas refuse the whole tool
list. Every JSON value satisfies `{}`, so the shared JSON value schema
now advertises that. Runtime parsing still admits only JSON values.

Refs #919

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 11:48:57 +08:00
Ysopwnable 28f10cf2bc docs: simplify the English README and organize guides (#1043)
* docs: simplify the English README

Preserve the opening and add the official skills.sh badge. Move setup diagnostics and CLI/Evidence details into guides, add three website showcases, and check setup-client facts in the installation guide.

Refs #1017

* docs: add README workflow and FAQ

Restore the original Disclaimer verbatim, invite community showcases, reuse the website investigation figure, and answer six common questions.

* docs: clarify README updates and collapse FAQ

* docs: welcome contributions in the README

* docs: highlight website guidance before quick start

* docs: keep README capability links aligned with main

* fix(docs): preserve README backlinks and release checks
2026-10-08 11:44:00 +08:00
2bf3663f65 feat(browser): inspect historical web network captures (#992)
* feat(browser): inspect retained HAR and mitmproxy capture evidence

Add independent offline format adapters, inline CLI/MCP evidence, bounded
owned decoder processes, and real producer verification.

Refs #882

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): preserve capture boundaries during cancellation and decoding

Honor cancellation during owned-command cleanup, retain opaque HAR
extension content, and clean verifier resources on every failure path.

Refs #882

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): exclude sensitive capture fields across representations

Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance.

Refs #882

Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)

* fix(browser): exclude sensitive capture identities and bound diagnostics

* fix(browser): validate excluded HAR subtrees before projection

* fix(browser): distinguish capture input limits from decoder failures

* fix(browser): preserve decoder failure categories

* fix(browser): validate excluded native credential values

* test(browser): report capture verifier assertions directly

* fix(browser): classify native representation failures precisely

* fix(browser): exclude URL userinfo after header whitespace

* fix(browser): preserve capture evidence and failure boundaries

* fix(browser): exclude sensitive literals from capture limitations

* test(browser): check limitation values without JSON syntax

* fix(browser): preserve acquisition integrity and exclude selection diagnostics

* fix(browser): preserve capture acquisition and declaration boundaries

* fix(mcp): project sensitive capture argument validation

* fix: preserve capture bytes and prelaunch cancellation

* fix(browser): exclude sensitive HAR record ancestry

* fix(browser): preserve transport URL and parameter exclusions

* fix(browser): preserve numeric redaction and canonical capture provenance

* fix(browser): cover derived capture values and ownership preparation deadlines

* fix(browser): exclude explicitly sensitive artifact digests

* chore: regenerate generated metadata

* fix(browser): reject lossy HAR member normalization

* test(browser): assert the advertised unsupported-profile outcome

* fix(browser): preserve JSON visitor nesting failure locations

* fix(browser): exclude explicitly sensitive native source ranges

---------

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 07:53:41 +08:00
Ysopwnable 6e4535c101 refactor(artifacts): move inventory and extraction into provider owners (#1032) 2026-10-08 05:51:14 +08:00
Ysopwnable c6dad93208 feat(ghidra): support native x86 PE applications on Windows (#1030) 2026-10-08 05:11:47 +08:00
morluto 63cf28fd8f fix(process): preserve partial evidence and verify detached cleanup (#1011)
* test(ci): allow transport delivery in source identity regression

* fix(process): preserve partial evidence and verify detached cleanup

* fix(process): scope Linux token sweeps by stable process identity

* fix(process): retain environment permission failure codes

* fix(process): wait for signaled processes before verifying cleanup

* fix(process): verify sampled detached groups during cleanup

* fix(electron): preserve prelaunch identities through cleanup

* fix(process): retry growing Darwin process table snapshots

* fix(process): retain compatibility with saved v3 capture evidence

* fix(process): migrate saved v3 captures during reconstruction verification

* fix(process): preserve cancellation during Darwin helper compilation

* fix(process): propagate cancellation through ownership baselines

* perf(javascript): cache canonical export comparison sort keys

* fix(process): cancel provider ownership preparation before spawn

* fix(process): isolate native compiler waiter cancellation
2026-10-08 04:46:46 +08:00
morluto 63ba7424c0 perf(javascript): cache canonical export comparison sort keys (#1028) 2026-10-08 04:35:32 +08:00
Ysopwnable 28d5c397c8 fix(windows): allow Java to read retained target snapshots (#1027) 2026-10-08 04:33:01 +08:00
morluto aafdf8a01b test: prune redundant conformance checks and document test priorities 2026-10-08 04:03:24 +08:00
morluto f8a53a8c06 test: consolidate service and process fixtures 2026-10-08 04:03:24 +08:00
morluto d88d6c1897 test(cli): reduce repeated startup and filesystem setup 2026-10-08 04:03:24 +08:00
morluto 9c3479ed95 test(mcp): consolidate SDK schema checks and scenario ports 2026-10-08 04:03:24 +08:00
morluto 26829045d0 test(browser): consolidate CDP workflows and colocate parser coverage 2026-10-08 04:03:24 +08:00
morluto 1fd1989d34 test(providers): verify framing through client socket boundaries 2026-10-08 04:03:23 +08:00
morluto f517a5a1d7 test(javascript): consolidate source analysis and export regressions 2026-10-08 04:03:23 +08:00
morluto c93422a898 refactor: remove abandoned test-only analysis scaffolding 2026-10-08 04:03:23 +08:00
Ysopwnable 984fc27ce1 test(javascript): cover plain long-line loader identities (#1025) 2026-10-08 03:56:10 +08:00
Ysopwnable 0e25befe78 fix(cli): stream large JavaScript JSON results (#1024)
* fix(javascript): report application analysis progress on the CLI

* test(cli): preserve progress in filtered output checks

* fix(cli): stream large JavaScript JSON results

* test(cli): include streaming output in dispatcher fixture
2026-10-08 03:44:51 +08:00
morluto ed725dace4 test(ci): stabilize browser source identity fixture delivery (#1023) 2026-10-08 03:25:15 +08:00
Ysopwnable 7b18c58140 fix(javascript): report application analysis progress on the CLI (#1008)
* fix(javascript): report application analysis progress on the CLI

* test(cli): preserve progress in filtered output checks
2026-10-08 03:19:37 +08:00
Ysopwnable 51956c1a49 fix(ci): avoid slow Azure archive for the native cross compiler (#1016)
* fix(ci): avoid slow Azure archive for the native cross compiler

* fix(ci): use HTTPS for Ubuntu archive transfers
2026-10-08 03:08:53 +08:00
morluto 93731e17dd fix(ci): decouple stdio smoke tests from Linux display probes (#1014)
* fix(ci): decouple stdio smoke tests from Linux display probes

* test(ci): check compiled catalog without an initial target
2026-10-08 02:50:08 +08:00
Ysopwnable 6a278a68dd fix(release): support default credentials and record 5.0.0 boundary (#1012)
fix(release): support built-in credentials and refresh release boundary

GitHub now creates approval-required PR workflows for GITHUB_TOKEN-authored
opened/synchronize/reopened events. Restore optional custom credentials and
cover prepare/publish without a separate secret. Record the verified 5.0.0
checkpoint, public 133-tool catalog and package update in the installation guide.

Assisted-by: Sakuya (gensokyo-skills:sakuya-checkpointed-execution)
2026-10-08 02:26:29 +08:00
morluto 76e7e510bb perf(artifacts): replace quadratic ZIP overlap checks (#1013) 2026-10-08 02:08:39 +08:00
morluto 966cca8efe fix(release): sync 5.0.0 checkpoint back to main 2026-10-08 01:43:02 +08:00