morluto
3eae278da5
fix(frida): preserve unknown capture policy facts ( #9934 )
2026-11-10 23:56:32 -05:00
morluto and Cursor Agent
133a849b2e
fix(browser-scenario)!: preserve scenario evidence and coverage ( #9896 )
...
* fix(browser-scenario): page captured text on Unicode boundaries
* fix(browser-scenario): retain popup events when open metadata exceeds its budget
* fix(browser-scenario): redact saved secrets across wire encodings
* fix(browser-scenario)!: record parsed request actions in evidence
BREAKING CHANGE: New captures with request actions that save nothing include save: [] in the recorded parameters. Their scenario and Evidence digests can differ from older captures of the same scenario. Read retained captures with their original recorded digests and use the newly recorded digest for new captures.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 23:48:13 -05:00
morluto and Cursor Agent
a6e02657e6
fix(artifacts): preserve unknown relationship coverage ( #9904 )
...
* fix(artifacts): preserve unknown relationship coverage
* fix(artifacts): retain producer relationship availability
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:52:59 -05:00
morluto
72b07c58d4
fix(wasm): bind known WABT source provenance to its verified release ( #9927 )
2026-11-10 22:52:21 -05:00
morluto and Cursor Agent
4d711acffd
fix(settings): report Ghidra limits for the operations that use them ( #9903 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:54 -05:00
morluto and Cursor Agent
5821506eb2
fix(native): preserve Mach-O source and decode facts ( #9902 )
...
* fix(native): retain Mach-O file identity through completion
* fix(native): distinguish malformed Mach-O encryption facts
* fix(native): preserve Mach-O command and dylib coverage
* fix(native): preserve Apple dispatch fixup and declaration facts
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:26 -05:00
morluto
3c736dfe11
fix(targets): reject ambiguous native image selections ( #9933 )
...
fix(targets): refuse ambiguous slice and file mappings
2026-11-10 22:50:13 -05:00
morluto
82abd9e6ca
fix(v8): validate complete payload scan coverage ( #9928 )
2026-11-10 22:49:40 -05:00
morluto
29b41a7d94
fix(coverage): validate boundary identifiers at request admission ( #9919 )
2026-11-10 22:49:26 -05:00
morluto
41bd808c1f
fix(symbols): match exact Objective-C protocol labels ( #9938 )
2026-11-10 22:49:01 -05:00
morluto
847d59c947
fix(python): validate shared pyc header facts ( #9929 )
2026-11-10 22:47:29 -05:00
morluto
d39699ad0c
fix(validation): stop lexical failures before semantic conversions ( #9924 )
2026-11-10 22:47:18 -05:00
morluto
281db61890
fix(ntfs): preserve header facts alongside invalid fixup sequences ( #9923 )
2026-11-10 22:47:04 -05:00
2885347cde
test(ghidra): remove the retired processor-context suite ( #9915 )
...
* test(ghidra): keep the bridge context contract out of an empty suite
Source tests collect src/ghidra/GhidraFunctionValues.test.ts directly.
The empty describe failed that file with "No test found in suite" even
though every shard passed. Assert the bridge bindings at file level.
* test(ghidra): retire superseded source-text context assertions
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com >
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-10 21:20:07 -05:00
N0zoM1z0 and gensokyo-dev
a6a2527ade
fix(artifacts): revalidate cached MFT observations
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
f8fc572e4a
fix(ntfs): report contradictory declared record identities
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
ab9e5fa204
fix(ntfs): require space for the first attribute marker
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
8d45cb45c4
fix(ntfs): validate first attribute bounds in FILE records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
7712e3185e
fix(ntfs): retain incomplete coverage alongside fixup mismatches
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
466149169e
fix(ntfs): validate aligned FILE record extents
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1c2626edbd
fix(ntfs): reject reserved update sequence values
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
b16d18f198
test(artifacts): cover independently cancelled MFT traversals
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
14030e2f11
fix(ntfs): expose unrecognized FILE record flag bits
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
9505c73824
fix(artifacts): retain only the bounded MFT header sample
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1a446cdade
fix(ntfs): label the system flag independently of extensions
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
1ef7f02cae
test(ntfs): group MFT header and fixup regressions
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
7b86474be7
test(artifacts): use the MFT traversal iterable contract
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
5d10337709
feat(artifacts): expose a bounded sample of MFT record headers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
8eadb872f2
fix(ntfs): preserve full-width MFT log sequence numbers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
f170175ec8
fix(artifacts): retry interrupted MFT preparation
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
fbe09f84df
fix(artifacts): verify MFT source before publishing metadata
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
ebb480ba22
fix(ntfs): buffer the admitted MFT byte range once
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
da1f029c2f
fix(artifacts): admit MFT captures through CLI and MCP
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
4db9c166ef
fix(ntfs): report contradictory FILE record extents
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
29fd6a7d03
fix(ntfs): accept older FILE record headers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
d7338876d6
fix(ntfs): reject malformed MFT update sequence arrays
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
9df3f7174f
fix(ntfs): keep record identity across invalid MFT slots
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
N0zoM1z0 and gensokyo-dev
79e476204f
fix(ntfs): preserve MFT reference sequence numbers
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 10:03:35 +08:00
2SinceJuly
9c95218374
style(artifacts): apply the repository formatter to the MFT reader
...
The new NTFS $MFT files were committed unformatted, so the Static checks lane
failed on format:check. Formatting only; no behaviour change.
(cherry picked from commit dc6a6d40ff
2026-11-11 10:03:35 +08:00
2SinceJuly
d9d2641981
feat(artifacts): inventory NTFS $MFT record headers offline
...
An acquired $MFT stream had no reader, so an analyst holding one could only
treat it as an opaque file. Recognize the FILE signature of the first record
and inventory every record's header: sequence number, flags, used and total
bytes, base record reference and update-sequence array.
Each record's update-sequence fixups are verified against its sector
trailers. A mismatch keeps the header facts, is reported on the record and is
counted in the metadata, so a record that was not cleanly written is visible
rather than silently accepted. A missing or short array is reported as
unverified, a wrong signature stops the scan at its offset, and a trailing
partial record is reported as a byte count. Attributes, filenames and the
$UsnJrnl:$J journal are not decoded, so no path or change history is claimed.
Part of #9867
(cherry picked from commit ccb45f5712
2026-11-11 10:03:35 +08:00
morluto
e2585aa7ce
test(ghidra): qualify instruction mode with real provider
2026-11-10 17:58:04 -05:00
morluto
1d1c7f98ff
test(ci): repair verifier fixtures and cleanup assertions
2026-11-10 17:58:04 -05:00
morluto
b1f1b3eff3
fix(javascript): recognize inherited environment for NaN
2026-11-10 17:58:04 -05:00
morluto
c1d0f2bb45
fix(environment): retain response cleanup through shutdown
2026-11-10 17:58:04 -05:00
morluto
04de5f3200
fix(artifacts): recover interrupted reader preparation
2026-11-10 17:58:04 -05:00
morluto
fe791ff159
fix(browser): mask unused PNG transparency key bits ( #9890 )
2026-11-10 17:39:53 -05:00
morluto
4082375e73
fix(verifiers): preserve results and own cleanup through completion
...
Attempt independent resource cleanup without losing primary failures, retain unresolved owners, and publish completion after release. Bound existing producer commands, preserve helper return values, and settle startup and fixture children on failure.
Validation: 29 focused boundary tests passed; actual helper-value and import-bound filesystem cleanup controls passed. The real inert-child termination control and targeted JavaScript binding checks passed, alongside typecheck, lint and formatting. Live Ghidra, Cutter, Electron GUI and Windows addon qualification was not run.
2026-11-10 17:03:59 -05:00
morluto
dcee59f273
test: strengthen independent oracles and consolidate boundary coverage
...
Require delivered facts, exact cancellation and malformed-input boundaries, and independent metadata expectations. Transfer unique assertions into stronger keepers before removing duplicate cases and overwritten fixture writes; preserve all consumed core fixture bytes.
Validation: 1,190 focused tests passed with 39 platform-dependent skips; 134 composition and conformance tests passed. Typecheck, lint, formatting, discovery and Knip passed. Independent preservation reviews and targeted regression controls passed.
2026-11-10 17:03:59 -05:00
morluto
31018cf037
test: retain failed prompt harness cleanup for retry
2026-11-10 16:50:24 -05:00
morluto
17f0c6944c
test: require exact public views and export receipts
2026-11-10 16:50:24 -05:00
morluto