* fix(javascript): keep export bindings out of module views
Exported symbol bindings reuse the javascript-module node kind, so the modules collection counted one row per export alongside the owning module. On a CommonJS or ESM file with N exports, inspect_analysis_view reported N+1 module units, module pages listed indistinguishable rows sharing the module path, and item selection by selector.path failed with "Multiple modules have path".
Treat a node whose observations carry semantic_role export-binding as an export of its owning module, not a module unit, and exclude it from module entries. Export bindings remain distinct graph entities for export-shape comparison and version matching.
Validation: a domain regression in analysisView.test.ts and a CLI acceptance regression over a real CommonJS analysis both fail on main and pass with this change. Also ran the analysis view, MCP boundary, CLI boundary and JavaScript acceptance suites (125 tests), npm run check:fast, and the MCP catalog schema test after regenerating .cache/mcp-tool-catalog.json.
* test(javascript): run the export-binding view case on the shared CLI
The case starts a compiled CLI process for each of its three commands,
paying startup and tool registration three times per run. The fixture
already provides a file-scoped process for calls with no stdin or explicit
timeout, so use it.
* style(javascript): format the constructed-evidence type in the module-view case
The acceptance case's inline graph type did not match what oxfmt emits for the
80-column limit, so `format:check` refused the tree. Reflow only; the assertions
are unchanged.
* style(cli): wrap the native data type path description
The `inspect-native-data-type` argument description line is 82 columns, over the repository's 80-column `.oxfmtrc.json` limit, so `npm run format:check` fails on main and on every branch merged from it. It came in with #9465 and the following commits to this file did not touch it. Reformat the one call the formatter objects to; no behaviour change.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(javascript): analyze first-party sources before dependencies
Every source in one application analysis charges the same parent result
budget, and sources were offered in lexical inventory order. On an Electron
app.asar, node_modules/ sorts before an electron-vite out-*/ directory, so
dependency files spent the budget and every first-party main, preload, and
renderer file had its semantic analysis not started and its application
projection rejected. The summary then reported zero windows, preloads, and
bridges while electron_semantics still said "recovered".
Offer application JavaScript before JavaScript under node_modules; reported
files keep inventory order. Count Electron boundary facts only from files
whose projection was admitted, and report electron_semantics "partial" (with
a limitation naming the count) when an Electron-loading source was not fully
examined or reported.
Fixes#9321
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): treat limited Electron examination as partial coverage
A static pass can stop early at the Electron wrapper expansion budget or
another resource limit without failing the worker. Such a source carries no
analysis or projection failure, so its retained IPC or bridge facts still
reported electron_semantics "recovered". Read the owned examination status
and count a limited Electron-loading source as incomplete.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(wasm): admit compatible 1.0.x WABT releases
REA_WABT_BIN_DIRECTORY admission compared each --version banner to the
literal 1.0.42, so a Homebrew or rolling-distribution WABT that advanced
past that build was refused even though wasm-validate, wasm-objdump and
wasm2wat accept the same flags and emit the same output shape. Callers had
to keep a hand-extracted 1.0.42 tarball alongside the system package.
Admission now accepts the release range ^1.0.42 and records the observed
banner, matching how the Wakaru adapter already admits compatible builds.
The verified release stays the reference: a banner other than 1.0.42 is
retained as tool_profile.release and provider.version and the report states
that only 1.0.42 was verified. All three tools must report the same release,
since one directory is one installation. Managed downloads stay pinned.
Fixes#9197
* fix(wasm): bound WABT admission to releases the report schema accepts
WABT_ACCEPTED_RANGE was "^1.0.42", which also admits 1.1.0 and later 1.x
releases, while wasmArtifactSchema only accepts 1.0.x banners. A configured
tool reporting 1.1.0 therefore passed version admission, ran the inspection,
and then failed at report parsing. Use the explicit ">=1.0.42 <1.1.0"
range so admission and the schema agree, and test the boundary.
Also carry the compatible-release warning into both partial-Evidence
builders. Previously only successful reports stated that REA verified
1.0.42, so a validation rejection or later read failure under a
compatible release silently dropped the uncertainty that a success reports.
Share the text through wabtReleaseLimitation so both paths stay aligned.
* fix(wasm): stop claiming the 1.0.42 commit for a newer admitted release
A caller-supplied 1.0.43 or 1.0.44 was admitted with the observed banner in
tool_profile.release, but source_commit still carried the 1.0.42 revision,
which is a claim about a build that did not run. Emit null for any release
other than the verified 1.0.42; the observed release and each executable
digest still identify what actually ran.
Also spell the accepted range as it is defined (>=1.0.42 <1.1.0) in the guide
and the failure fixture instead of ^1.0.42, which in semver admits 1.1.0.
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
* feat(native): page retained feature traces
* fix(snapshot): retain linked source evidence for replay
* test(snapshot): verify linked foreign evidence stays scoped
* feat(native): page retained procedure references
* docs(mcp): clarify imported residual questions
* docs(mcp): guide trace reference classification
* fix(cli): report result sources when Evidence publication fails
A trace keeps linked sources on the result. Use those records for the
undelivered source closure as well as the bundle, so a refused output
does not report them as not captured.
* ci: rerun pull request checks
The merge of origin/main did not start the CI workflow for this head.
* fix(native): document shared procedure endpoints and the required selector
Describe kind shared and items.endpoints instead of inline procedure copies.
State that procedure-references requires a positional selector or --procedure.
* fix(native): count procedure-reference endpoints before keeping a row
Include the shared endpoint table in the page budget, with JSON punctuation,
and store a new procedure only when its row is accepted.
* fix(native): measure a procedure endpoint once before its comparison key
Size the candidate before building one canonical identity, and reuse that
key for the selected-procedure and shared-endpoint checks.
* fix(native): reject an oversized procedure endpoint before canonicalizing it
When the JSON size already exceeds every stored identity, skip the canonical
string and keep the row out of the page.
* fix(native): describe procedure-reference direction and coverage
Avoid execution wording in the tool description, and give the CLI direction
option the help text the catalog requires.
* fix(native): compare endpoint size with UTF-8 identity length
Keep one running maximum of stored identity bytes. A multibyte selected
procedure is recognized when its JSON no longer fits the page.
* test(cli): count procedure-references as a dedicated command
The MCP tool has a CLI command, so it is no longer an MCP-only exception.
* test(native): catch the string-length endpoint comparison
Use a 200,000-character multibyte selected procedure and a shorter ASCII
endpoint so the old JavaScript length check drops the selected row.
* ci: rerun after the binary-layout toolchain timeout
The required check failed because the toolchain install exceeded 15 minutes.
The same job completed on the previous head, and this commit does not change
the procedure-reference behavior.
* test: stabilize capture decoder exhaustion coverage
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* docs: organize canonical documentation layout (URGENTE)
Group all existing authored guides by domain and ownership, expose complete navigation, and preserve their public routes. Update physical path consumers and release configuration while retaining historical records. Document domain-based specs and ADR slugs without global numbering.
Co-Authored-By: Codex <noreply@openai.com>
* fix(docs): honor home layout in all-page route verification
* style: format reviewed source changes
* fix(docs): preserve routes and navigation cache inputs
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(docs): update links after guide relocation
* docs: correct verified documentation route counts
* fix(docs): update browser capture guide link after move (#2820)
Refresh gettext protected-link comments alongside the authored href.
Co-authored-by: Codex <noreply@openai.com>
* fix(docs): include http3 lab in stable routes
* fix(docs): preserve historical release evidence and links
* fix(ghidra): restore Windows verifier identity import
* docs(wakaru): preserve pinned upstream policy link
* docs(index): retain recently added guide links
* docs(mcp): preserve parent retention clarification
* fix(cli): preserve standalone import guidance
* fix(test): preserve translated guide link drift coverage
---------
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: morluto <17176810+morluto@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
