* feat(desktop): capture, draft, export and witness a task inside a build computer
- start_build_capture runs REA's capture inside the computer through a
small controller over computer-exec, after a user-space apt-get update;
mark_build_checkpoint returns once the capture confirms the checkpoint;
stop_build_capture returns the draft between seed and end.
- export_build_environment exports with the requester's task inside the
computer and fetches the bundle through data/get in bounded batches.
- check_build_task grades a computer's data/get with REA's evaluator and,
through seed, after_edit, near_miss and after_reset stages, records a
witness with the action log and the screen recording; act_on_build_computer
gains reset.
- Capture progress lines carry window, checkpoint and refusal events; apps
start in the home; a pack script builds the runtime archive; long tools
send progress notifications.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): make build capture and witness steps retryable, and close the near-miss reset hole
- A capture whose start answer is lost is stopped at once and kept
unreleased until the stop is confirmed; a lost checkpoint answer is
recovered from the capture's own log, and draft and export use the
checkpoints its Evidence records; stop can be repeated to resume
reading its result.
- A witness can check its seed again after a failed read, and keeps its
stages in a saving state until the record is written, so a failed save
can be retried without reading the app again.
- after_edit and near_miss count only click, drag, scroll, type and key,
so a reset no longer stands in for the near-miss edit.
- A .deb build keeps its package file for capture and passes its URL to
export; bundle downloads write each checked file before fetching the
next; an apt-get update failure reports its exit code and log tail;
reset sends progress while it waits.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep the Trash out of seeds, bundle folders unwritten and first frames drawn
From the blind Inkscape rebuild:
- Paths in ~/.local/share/Trash get a desktop_trash reason and the
shared_desktop role, so a file trashed before seed is neither owned nor
seeded; the export names it in a limitation.
- The keep helper runs with PYTHONDONTWRITEBYTECODE=1, so starting a
computer from a bundle folder no longer writes __pycache__ into it.
- start_build_computer waits, bounded, until the first frame is not one
colour before returning it.
From review: a .deb that apt also offers exports from apt, since export
passes --package-url only when the capture says the package must come
from its file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): bound the first-frame wait's retries to the time left, with progress throughout
Each retry of the drawn-first-frame wait runs under an abort that fires at
the 10 s deadline, and the latest frame is returned when time runs out.
connect takes the first frame itself while its progress heartbeat still
runs, reporting "waiting for the desktop to draw". The wait moves to
DrawnScreenshot.ts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): serialize each build computer's calls, keep one recording id, and separate unreadable checks from failures
- One queue per computer: actions, capture steps and witness checks run one
at a time, so two overlapping after_edit checks can no longer both be filed
and let the witness hold without a near miss. Close cancels the running and
queued calls; different computers still run concurrently.
- The witness keeps one recording request id per computer, so a seed retried
after a lost reply recovers the recording it started.
- A check that could not read its file is undecided, not a failure, so a
temporary read error can't satisfy seed, near_miss or after_reset; such a
stage is refused and can be checked again.
- The export's file listing is written to a file and read back in bounded
batches, so a large bundle no longer overruns exec's 1 MiB output.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): treat failures on cut views as undecided, require a decided seed failure at export, and keep a close's cancellation
- A presence check that misses its line, row or pointed value in a view cut
short is undecided rather than failed, since the data may sit in the part
left out; a witness stage can no longer be proved by such a failure.
- Export counts only decided failures on the seed, and refuses a task whose
every seed failure is undecided.
- A step whose turn was aborted by a close or the caller returns cancelled
even when its work finished, so start_build_capture no longer reports
success for a computer being removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a step's saved result when a cancellation arrives during its commit
Reporting cancelled for any step whose turn was aborted after its work
replaced a completed export or witness save with a bare cancellation, losing
what was saved and leaving the witness unreadable. Steps now return what they
completed; only start_build_capture, which commits nothing, checks its turn
after the post-launch screenshot and reports cancelled. Asking again for a
saved witness's final check returns its record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): refuse a saved witness's repeated check for another folder
Asking again for the check that ended a witness returned its saved record
whatever directory came with it, so a caller naming another folder got
success though nothing was saved there. A different folder is now refused,
as an unfinished seed's retry already is.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): assert the facts of cut-view and undecided outcomes, not their sentences
The new cut-view, missing-value, undecided-refusal and witness tests froze
whole descriptions, so a harmless rewording broke them. They now check each
outcome's id, passed and undecided exactly and the facts its message must
carry (file, pointer, line, row, stage) separately.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text
- Both readers accept a DOCTYPE with only a name and an optional PUBLIC
or SYSTEM identifier, record it as the view's doctype, and never fetch
the DTD or expand entities beyond XML's five; an internal subset, an
external entity and a parameter entity stay refused alike.
- text_equals and text_contains compare the concatenated text of the
element (or text node or attribute) a pointer reaches, as XPath
string() does, with optional normalize_whitespace; both evaluators
agree, and a text check on a truncated element is undecided.
- Whitespace-only text between elements is dropped only when the element
holds no other text, so text split into runs keeps its spaces.
- The draft suggests text_equals for an element whose text changed.
So an AbiWord .abw reads as XML, and its paragraph's text is checked
whole however AbiWord splits it into <c> runs, as Writer's spans are.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps
- A changed value is read at both ends, so text that became a run still
marks its paragraph, and the drafted text_equals moves up out of mixed
content to the nearest ancestor named by an attribute, such as
AbiWord's p by its xid.
- Text checks accept only a text node or an attribute value; element
names and doctype fields fail, in both evaluators.
- isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy).
- XML files are drafted with the keyed diff the archive entries use, so
no suggestion reaches an element by position; the shared logic moves to
appTaskDraftNamed.ts.
- Text-check tests assert facts, not whole sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs'
A drafted whole-text check on a paragraph hid every change inside it, so a
link whose label and href both changed drafted only the paragraph's text and
the new destination went unchecked. The text check now covers text and runs
added or removed whole; a changed name or attribute of an element both
versions hold keeps its own check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check
The owner of `.../attributes/name` was taken as `.../attributes`, so a
changed `name` attribute inside a paragraph with a text check was dropped
again. The owner is now read by segment, attributes first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container
Text typed into a run the diff lists whole was never read, so the draft kept
only a presence check on the run, which wrong text also passed. Such text now
marks the nearest element both ends hold, or, when none can take the check,
the added element's own text. The climb also names an element by an
identifier of its own (id, xml:id, xid) before a larger container, so a
headline under a long layer keeps a whole-text check that survives re-split
runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): expect the whole-text check where #8988's pairing test meets text checks
On this branch a changed element's text is drafted as `text_equals` on the
element, so the identity pairing test now expects that check, under the
same `[@role=body]` key.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(skills): build a computer-app environment from a request
The product skill gains references/desktop-build.md, a procedure that
takes Claude from a request such as "an Inkscape environment where the
agent changes a poster's headline" to a witnessed bundle and a report,
through start_build_computer, act_on_build_computer, the build capture
tools, export_build_environment and check_build_task: questions asked
once upfront, pauses only when blocked, a seed made in the app, content
checks by selector, a witness with a near miss and a reset in a fresh
computer, and solver runs only within a budget. setup installs the new
reference; skillVersion 61.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): fold the blind Inkscape rebuild's friction into the build skill
key takes an array of one chord's keys; check for a text cursor before
typing in apps with single-key shortcuts; in Save As, click Documents and
type only the file name; anything saved before seed, the Trash included,
is part of the seed; dismiss first-run dialogs before seed; a bundle's app
starts with the seed's files but need not open the document; Inkscape's
window class is Inkscape.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): fold the held-out AbiWord build's friction into the build skill
Name the act fields and link the guide; a region screenshot becomes the
latest frame; a drawn caret is not focus; confirm dialogs with Return;
check the dialog's folder when the app shows only a name; an XML file the
draft shows as lines was read as text, so use short line checks; and keep
text checks to the value the edit types, since some apps save a reloaded
document differently. Later witness stages take no directory.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): state the export's seed rule, the Trash exception and draft refusals exactly
The export refuses a task unless at least one check fails on the seed and
every check passes at the end; a file moved to the Trash is left out of
the seed, so trash a stray file rather than starting over; a null draft
names its cause in draft_refusal; and a line check on a format read as
text only approximates a value, so bound it and call it approximate.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): teach the build skill to use DOCTYPE and whole-text checks
The skill now checks text an app splits into runs whole with text_equals or
text_contains, finds an AbiWord paragraph by its xid, and drops the Writer
revision-id workaround.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(skills): point text checks at the paragraph, and say what the scrub replaces
From the AbiWord rebuild: point a text check at the paragraph or another
element the edit keeps, never at a run a reopened document splits; how to
name an unchanged element; the export replaces the host name, user@host
and home path while a bare user name stays; AbiWord's entry and class.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep every text check on a cut element undecided, in both evaluators
The XML reader drops text deeper than its depth limit but keeps later
siblings, and an element's whole text joins both sides, so a text_contains
on a cut element could match text the file never holds ("at 3" + deep
"WRONG" + ":30 PM" read as "at 3:30 PM"). Any text check on an element of a
cut view is now undecided again, as #9050 had it, in REA's evaluator and the
exported verifier; a text node or attribute value stays decided. The text
check tests assert facts rather than sentences.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a reset applied when the screenshot asked after it fails
Once data/reset and the ready wait succeed, act_on_build_computer's reset
is applied in the action log and returns success; a screenshot asked of it
that is then refused or throws is named in the result's screenshot_error,
with no frame, so the next after_reset stage is not refused. Cancellation
still propagates.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings
A review found two gaps.
- A paragraph's whole-text check covered every element added or removed
inside it, including ones holding no text: an image frame, a line break.
A solver who typed the text but never inserted the image passed. Such an
element now keeps its own presence or absence check.
- The Python reader kept a DOCTYPE system literal's CRLF where TypeScript
normalizes it to LF. Both now report LF.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): wait out long build commands, fail a reset that restores nothing, and tie the witness to its bundle
A review found five gaps.
- Commands in the computer answer only when they end, but fetch stops
waiting for headers after 300 s. So a slow export, draft or start always
failed. A command with its own deadline now waits on node:http, bounded
by that deadline.
- after_reset held whenever some check failed, so a reset that changed
nothing passed on the near-miss state. Each check must now come out as it
did at the seed.
- A failed or partial apt-get update left lists that looked complete, so a
second start skipped the update. The update is now recorded only when it
succeeds, and rerun otherwise.
- A witness on a bundle computer graded whatever task it was given. Its
seed stage now refuses a task whose steps or checks differ from the
bundle's.
- A task too large for one command argument (96 KiB) is refused before the
export runs, instead of failing with E2BIG in the computer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): advertise a checkpoint-name pattern that compiles in every JS regex mode
main's advertised-pattern test compiles every input schema pattern in v
mode, which refuses an unescaped hyphen in a character class. The
checkpoint name's hyphen is now escaped, and it means the same in u mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(desktop): import textSyntaxFormat once in the state format tests
main's mixed-case JSON suffix fix and this branch both added the import,
and the merge kept both.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(desktop): keep a completed reset, an unread seed, and a failed apt update
A cancel after data/reset no longer drops the restore from the action log,
so a near miss cannot treat the restored seed as an edit. An unreadable
seed check that later passes leaves after_reset undecided instead of
failing the witness. apt-get update is kept only when Error-Mode reports
success and a package list was fetched. The controller reply schema lives
with the controller, and capture progress lines are read by their domain
parser.
* fix(desktop): keep a whitespace-only run under the paragraph text check
A run whose only text is whitespace is still text the paragraph check
reads. It no longer gets its own presence check, which a later save of
the same words without that run would fail. Images and breaks, whose
text is empty, still keep their own checks.
* fix(desktop): keep an unread reset and a cut text check undecided
after_reset stays undecided when any check was not read, even if another
check still fails and the unread result's boolean matches the seed. A
text check for a child past a truncated view is undecided in both
evaluators. A reset whose reply is lost blocks a near miss until a later
input or a reset whose reply arrives.
* fix(desktop): retry a witness recording and a published record's cleanup
A recording that fails to end or download is not written into the witness
folder, and a manifest already received is fetched again without ending
the recording twice. A folder that is published while its handles fail to
close keeps that record and retries the same cleanup instead of writing
the folder again.
* fix(desktop): keep a published witness error and tag an app data refusal
A second failure to close a published witness returns the original error,
so its record and cleanup lease stay bound. A reset the app itself
refuses is an AppDataRefusal; only a reply that is not that refusal stays
unsettled. A missing child of a cut view is undecided with the same
description in both evaluators, and the shared cases cover it.
* fix(desktop): align a cut view's missing text with the Python check
A missing child of a truncated view is undecided for the same sentence in both evaluators, including the pointer the view does not contain.
* fix(desktop): keep one published witness cleanup across retries
A published record and its bound cleanup error stay together. A later close failure returns that error, and the unused path that built a fresh adapter error is gone.
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: morluto <morluto@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* feat(native): page retained feature traces
* fix(snapshot): retain linked source evidence for replay
* test(snapshot): verify linked foreign evidence stays scoped
* feat(native): page retained procedure references
* docs(mcp): clarify imported residual questions
* docs(mcp): guide trace reference classification
* fix(cli): report result sources when Evidence publication fails
A trace keeps linked sources on the result. Use those records for the
undelivered source closure as well as the bundle, so a refused output
does not report them as not captured.
* ci: rerun pull request checks
The merge of origin/main did not start the CI workflow for this head.
* fix(native): document shared procedure endpoints and the required selector
Describe kind shared and items.endpoints instead of inline procedure copies.
State that procedure-references requires a positional selector or --procedure.
* fix(native): count procedure-reference endpoints before keeping a row
Include the shared endpoint table in the page budget, with JSON punctuation,
and store a new procedure only when its row is accepted.
* fix(native): measure a procedure endpoint once before its comparison key
Size the candidate before building one canonical identity, and reuse that
key for the selected-procedure and shared-endpoint checks.
* fix(native): reject an oversized procedure endpoint before canonicalizing it
When the JSON size already exceeds every stored identity, skip the canonical
string and keep the row out of the page.
* fix(native): describe procedure-reference direction and coverage
Avoid execution wording in the tool description, and give the CLI direction
option the help text the catalog requires.
* fix(native): compare endpoint size with UTF-8 identity length
Keep one running maximum of stored identity bytes. A multibyte selected
procedure is recognized when its JSON no longer fits the page.
* test(cli): count procedure-references as a dedicated command
The MCP tool has a CLI command, so it is no longer an MCP-only exception.
* test(native): catch the string-length endpoint comparison
Use a 200,000-character multibyte selected procedure and a shorter ASCII
endpoint so the old JavaScript length check drops the selected row.
* ci: rerun after the binary-layout toolchain timeout
The required check failed because the toolchain install exceeded 15 minutes.
The same job completed on the previous head, and this commit does not change
the procedure-reference behavior.
* test: stabilize capture decoder exhaustion coverage
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(ghidra)!: distinguish skipped overlays in byte search
BREAKING CHANGE: Byte search results require skipped_overlays; loaded overlays no longer appear in skipped_not_loaded. The Ghidra profile changes so prior snapshots are not replayed.
* fix(cli): explain overlay byte search scope
* test(ghidra): exercise overlay search cursor handoff
* test(ghidra): avoid freezing byte search help wording
* test(ghidra): classify search start as an address bound
* docs(ghidra): match the raw lane's overlay coverage
The raw Ghidra lane checks a manually created overlay block through MCP.
Say that, and do not claim an overlapping-load ELF, CLI search, or snapshot
cursor handoff.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* feat(kuna): verify release 1.990
* feat(kuna): preserve stored pointer references
* fix(kuna): group image-wide reference coverage gaps
* fix(evidence): retain producer-required xref observations
* fix(mcp): clarify xref address page scope
* fix(kuna): preserve reference target aliases
* feat: page recorded evidence arrays
* fix(mcp): guide large evidence views to files
* fix: preserve source context in recorded views
* fix: keep recorded rows accessible with large context
* fix: disclose alias scope in recorded references
* test(kuna): identify pointer fixture version
* fix(view): keep deep recorded-array pages inside Evidence depth
Parent parameters are valid on the Evidence root and one level too deep
under a page result. Omit those parameters, and refuse a row that still
cannot be nested, instead of throwing from Evidence parsing.
* test(view): narrow recorded-array depth pages before reading parameters
* fix(view): validate recorded page rows once
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(native)!: preserve value-flow absence semantics
* fix(mcp): report native value flow support in session status
* test(mcp): share schema validation and assert status facts
* chore: preserve unrelated main imports
* feat(mcp): report provider release verification in session
* test(kuna): verify release guidance at its owner
* fix(kuna): verify release against reported version
* test(mcp): keep temporary fixture cleanup with its owner
* fix(ghidra): guide ambiguous procedure selection
* test(ghidra): distinguish malformed selectors
* fix(ghidra): distinguish ambiguous file mappings
* fix(ghidra): name mapping inspection workflows
* docs(mcp): expose strict Ghidra address selection
* docs(cli): explain Ghidra qualified address selection
* test(ghidra): cover published ambiguous selector codes
MCP and projection tests use procedure_ambiguous and file_offset_ambiguous,
and match the recovery main already publishes for those codes.
* fix(ghidra): name the space-qualified address that avoids offset fallback
file_offset_ambiguous now tells the caller to use a form such as
ram:0x1000. A bare 0x selector repeats the file-offset lookup. The MCP
test requires that route and inspect_native_load_image.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(ghidra)!: preserve facts in inventory searches
BREAKING CHANGE: Ghidra snapshots made before the search projection profile revision no longer match. Run fresh analysis and save a new snapshot.
* test(ghidra): update raw profile digest goldens
* test: focus assertions on behavioral evidence
Prune redundant and wording-coupled checks while retaining diagnostic, parser, recovery, and cleanup coverage.
* refactor: remove test-only wrappers and duplicate checks
Exercise production operations through test fixtures, remove unused adapters, and keep managed-member uncertainty guidance under its existing owner.
* test: focus process validation on diagnostic facts
* refactor: remove test-only runtime helpers
Move semantic evidence fixture setup out of runtime and remove unused Windows settle recovery helpers while checking configured defaults independently.
* test: focus artifact diagnostics on format facts
* test: verify retained cleanup guidance delivery
* docs: organize canonical documentation layout (URGENTE)
Group all existing authored guides by domain and ownership, expose complete navigation, and preserve their public routes. Update physical path consumers and release configuration while retaining historical records. Document domain-based specs and ADR slugs without global numbering.
Co-Authored-By: Codex <noreply@openai.com>
* fix(docs): honor home layout in all-page route verification
* style: format reviewed source changes
* fix(docs): preserve routes and navigation cache inputs
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(docs): update links after guide relocation
* docs: correct verified documentation route counts
* fix(docs): update browser capture guide link after move (#2820)
Refresh gettext protected-link comments alongside the authored href.
Co-authored-by: Codex <noreply@openai.com>
* fix(docs): include http3 lab in stable routes
* fix(docs): preserve historical release evidence and links
* fix(ghidra): restore Windows verifier identity import
* docs(wakaru): preserve pinned upstream policy link
* docs(index): retain recently added guide links
* docs(mcp): preserve parent retention clarification
* fix(cli): preserve standalone import guidance
* fix(test): preserve translated guide link drift coverage
---------
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: morluto <17176810+morluto@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
* feat(native): retain LLDB source coordinates and verify Pascal call entries
Preserve partial line-table attribution for native locations and historical
evidence compatibility. Verify owned Free Pascal call entries through CLI/MCP.
Refs #2382, #2372, #2397
Co-Authored-By: Codex <noreply@openai.com>
* docs: namespace native specifications by domain and feature
Use stable descriptive paths instead of numeric prefixes to avoid parallel contribution collisions.
Co-Authored-By: Codex <noreply@openai.com>
* fix(native): bound Pascal verification and compare caller coordinates
Address review findings at their producing boundaries and preserve directly affected consumers. Source inspection and git diff --check completed. Tests and automated checks were not run at the user’s explicit request.
* fix(native): bound compiler shutdown and source-coordinate fixtures
* docs: clarify historical native source verification
* fix(native): preserve source attribution and compiler ownership
* docs(native): qualify retained source attribution
* fix(ci): clean up native Pascal verifier processes
* test(native): type the Pascal verifier helper import after merging main
Main now typechecks this boundary test, which imports the untyped
canonical-temporary-directory helper and reads an unknown catch value.
Add the helper's declaration file and narrow the caught error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(native): verify partial source attribution caveat
* fix(native): retain verifier compiler cleanup ownership
* fix(native): forward verifier cancellation and measure path bytes
CLI and MCP artifact runs observe the verifier abort signal, and a
failed Pascal verifier test stops the compiler group before deleting
its directory. Repeated source locations grow by measured UTF-8 JSON
bytes; workflow tokens, CPU and peak memory stay unmeasured.
---------
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* test: assert absolute-path facts without frozen sentences
Sibling path tests now require the field path, invalid_format, and regex
expectation, and they record that each negative case ran. NUL rejection
follows the argument that contains the byte instead of searching for the
word NUL.
* test: retain actionable NUL path diagnostics
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
The help renderer appends "(default: X)" whenever the option field declares a
schema default, so descriptions that also spell the default out print it twice:
--block-size <value> Power-of-two block size from 256 to 65536 bytes
(default 4096) (default: 4096)
Remove the hand-written default from the eleven options that own a schema
default across inspect-byte-entropy, inspect-devicetree,
inspect-packet-capture, inspect-packet-fields, inspect-signal-decoders and
decode-signal-recording, matching the rule in cliDecimalField's contract that
the domain field owns bounds, defaults and help.
Options without a schema default keep their prose: --match_limit, --line_limit,
--limit and --packet_limit are nullable or optional, so the renderer emits no
annotation and the description is the only place the effective value appears.
Add a boundary test asserting each such option states its default exactly once,
so a restated default cannot come back unnoticed.
Expose the existing opt-in Ghidra checkpoint lifecycle in tool descriptions and summary capabilities. Distinguish confirmed initial analysis from restored Programs, preserving the checkpoint path and digest through shared CLI/MCP results.
Remove prose-driven checks and their scaffolding; retain canonical effects and lifecycle/source-fact coverage. Validated with 445 focused tests, 13 real Ghidra CLI/MCP scenarios and three isolated local Codex CLI tasks covering disabled setup, saving edits and fresh-agent restoration.
* fix(cli): advertise domain constraints for selector and path options
Android class, method, and mapping fields, ADB setting keys, and browser
endpoints used bare strings in --schema. They now reuse the domain fields,
so empty selectors, relative mapping paths, and malformed setting keys
fail in the advertised schema.
* fix(cli): keep selector limits when argument parsing rejects them
Empty browser and Electron selectors now fail in the CLI parser, so their
diagnostics are VALIDATION_ERROR with the one-character minimum. ADB
setting keys stay on the selector repair path, which restores maximum 256
and the identifier pattern.
* test(cli): assert empty-selector codes without frozen prose
Empty browser and Electron selectors still fail as VALIDATION_ERROR
too_small on the named field. The tests no longer copy Zod's sentence.
* test(cli): compare endpoint diagnostics with the domain schema
Browser and Inspector tests take custom issue text from the schema that
owns it, and empty capture comparison must name both missing inspection
fields.
* fix(cli): remove duplicate merged schema import
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(mcp): advertise absolute paths for tools that reject relative inputs
The domain schemas accepted relative paths, then handlers rejected them
with isAbsolute. Those inputs now use absoluteLocalPathStringSchema, and
the duplicate handler checks are gone.
* fix(javascript): own recovery path admission in the schema
Relative recovery paths now fail in absoluteLocalPathStringSchema, including
the additional_paths index. Drop the duplicate handler check, and make the
CLI, MCP, and tools/list tests assert that schema fact.
* test: assert absolute-path facts instead of error prose
Recovery and web-script tests keep the field, format code, and regex
expectation. They no longer freeze the schema's explanatory sentence.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Add opt-in REA_GHIDRA_CHECKPOINT_DIR for owned Ghidra Program persistence through the shared CLI/MCP provider. Save completed initial analysis and metadata changes on normal close; verify and restore the last successful packed Program without auto-analysis.
Preserve generation identity, exclusive ownership, typed cancellation and cleanup retry. Refresh checkpoint-dependent profiles after retirement, including failed-switch restoration, while retaining caller selection provenance. Keep source executables and caller projects unchanged.
Validated with 720 focused tests (3 platform skips), 13 real Ghidra CLI/MCP scenarios, static/docs checks and CI. Review findings addressed. No version bump or release publication.
Refs #8165.
morluto