rea-agents 6.9.0 advertised `^[^\uD800-\uDFFF]*$` on every local path
input. RE2 has no `\u` escape and Rust's `regex`/`jsonschema` crates refuse
non-scalar code points, so strict MCP clients and gateways (DeepSeek, RE2
gateways, Open Design) rejected the complete tools request and no REA tool
could run.
Move the rule into one runtime check, `rejectUnpairedSurrogates`, which
advertises nothing and still raises the `invalid_format` regex issue, so
CLI and MCP corrections keep reason, expected value, and message. The
objdump disassembly symbol already enforced the same rule with its own
refinement; it now shares the owner and the correction shape.
Dropping the pattern also brings inspect_android_jni_bindings within the
compact profile's per-schema budget, so compact delivery now keeps its
DEX dimension pattern. The descriptor admission test follows the actual
presentation instead of assuming compact always omits it.
Fixes#10238Fixes#10348Fixes#10198
Co-Authored-By: gensokyo-dev <gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): preserve own state keys in task witnesses
* test(desktop): preserve witness parse failure details
* fix(desktop): retain own column keys in task conditions
* fix(contracts): drop nested defaults from a root union sibling
Flattening a union of strict object groups lifts each group's properties
into one object. A default the scenario group carried inside
normalization.rules survived that lift even though the passive group
declares no normalization, so a client that fills nested defaults sent
{normalization: {rules: []}} and the runtime parser refused the call
with "Unrecognized key: normalization".
Remove defaults below a property that any group omits, not just the one
on the property itself. A property every group owns keeps its own
nested guidance.
* fix(contracts): keep a nested default a reference still targets
Dropping the nested default of a property a sibling group omits also removed defaults that references point into. A resource whose validation $ref targets its own default was advertised with that reference intact but its target gone, so the advertised schema no longer compiled in AJV or client projection.
Collect the paths into a default that references inside the branch target and keep those entries while stripping the rest. Other nested defaults are still removed, so the strict sibling group keeps refusing the object.
* test(contracts): type the root union default regression fixture
The fixture spread the canonical branch through a widened cast, so the repository typecheck rejected the spread and indexed access. Narrow the branch shape and guard the optional schema before collecting its referenced defaults.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
* docs(native): specify Windows ReFS filesystem authority
* docs(native): plan ReFS filesystem support
* feat(native): admit ReFS filesystem identities
* feat(native): support ReFS filesystem authority
* feat(native): advertise ReFS Windows support
* docs(native): format ReFS support documents
* docs(native): record ReFS verification tasks
* docs(native): record ReFS draft pull request
* docs(website): correct remaining ReFS translations
* fix(docs): correct Windows native guide link in ReFS plan
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(swift): classify private nested types by their own kind
Skip swiftc's file discriminator before the nominal marker so a private
nested enum, struct, or class is not filed under its enclosing type.
* ci: retrigger checks stuck in the Actions queue
The original workflow runs stayed queued while later runs on other
pull requests completed.
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Admission compared table offsets with the class minimum, so a larger e_ehsize still parsed those header bytes as program or section entries.
Co-authored-by: Cursor <cursoragent@cursor.com>
CSP3 requires a complete base64-value, so truncated and illegal nonce
and hash tokens were being reported as real sources.
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(setup): support Cline as a client
* test(setup): cover Cline doctor and uninstall ownership
* docs(setup): document Cline support
* test(setup): verify Cline against an installed client
* test(setup): include Cline in the exhaustive client detection list
* docs(setup): note that a hand-written rea entry blocks Cline setup
* fix(setup): isolate Cline verification and await MCP discovery
* fix(verification): own and isolate Cline discovery
* fix(setup): preserve native Cline transport settings
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
cctools lipo prints CPU_TYPE_I386 and CPU_SUBTYPE_I386_ALL for i386 slices, so their CPU codes were unknown and every i386 slice carried unnormalized-text limitations.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(hardening): recognize the __chk_fail FORTIFY handler import
glibc exports __chk_fail as the shared failure handler that most FORTIFY
checks funnel into, and its dynamic import is a positive sign that the
binary uses FORTIFY. The ELF FORTIFY matcher accepted __fortify_fail and
__*_chk names, so an image whose only relevant import was __chk_fail was
reported as fortify: unknown with no evidence location.
* style(hardening): wrap the __chk_fail fixture call to the formatter's width
format:check fails on the current head because the new fixture call fits on one line at the file's previous width but exceeds oxfmt's 80-column limit with the longer fortifyName literal.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
