* fix(hopper): report unavailable procedure body coverage
* refactor!: simplify runtime tools and remove replay engines
Keep direct inspection, capture, and comparison tools. Bind handlers to named contracts and let agents compose experiments with commands and local fixture servers.
BREAKING CHANGE: Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
* fix(platform): accept absolute paths for any host and stop blaming the ceiling for a missing grant
Addresses #548 and #545.
#548: processScenarioSchema required a leading "/" for executable,
working_directory and filesystem_roots, so no process scenario could be
expressed on Windows at all. The report suggested node:path's isAbsolute, but
that answers for the host running the check: on Linux `C:\tools` is not
absolute, so a scenario captured on Windows would fail validation when it is
replayed, compared, or asserted in a test on another host. A boundary schema
must not vary with its evaluator, so the check accepts the POSIX form, a
Windows drive path and a UNC share everywhere. The rejection message now names
the constraint instead of leaving the caller to infer it from "invalid request".
The HTTP `path` field inside `checkpoints` is an URL path and is deliberately
left alone.
I checked whether this merely moved the failure downstream: containment is
enforced by isPathWithinRoot, which already uses host-aware path.relative, so
validation really was the only blocker.
#545: when a scope is inside the administrator ceiling but no grant was ever
issued, the denial still pointed at widening the ceiling -- advice that cannot
help, since the ceiling already permits the operation. The `missing` payload is
computed against candidate *grants*, so it describes what a grant must cover,
not a ceiling gap. `PermissionRemediation` gains a `grant` variant saying
exactly that, and PermissionAuthority selects it when the denial is not a
ceiling violation. An explicitly requested remediation is still honoured, and a
genuine ceiling violation still says "configure".
* refactor(config): take the environment as an input at every configuration read
Completes B-2. Every `parseConfig(process.env)` site now reads from an
injected environment, so configuration-driven behaviour is a function of an
argument rather than of the machine running it.
The twelve sites were not equivalent, and treating them as one number would
have hidden the difference:
- **src/application/ (3 sites) were genuine defects.** `runSessionStatus`
already injected its `logger` but hardcoded `process.env` for config, so the
MCP path's `dependencies.env` never reached it; `captureProcessScenarioFile`
and `runAnalysis` had the same problem. `runAnalysis` gained `environment` on
the options object it already had, which is where its other injected
dependencies live.
- **The CLI command layer (9 sites) is a documented boundary,** where
`process.env` is legitimate. Rather than 9 independent ambient reads, they
now share one seam: `createCli(environment)` passes it to the seven
registrars that need configuration, and the nested helpers (`electronContext`,
`runtimeContext`, `loadConfiguredAuthority`, `inspectJavaScriptReplay`) take
it explicitly.
Every new parameter defaults to `process.env`, so all existing call sites are
unchanged and production behaviour is identical. The point is that the ambient
read is now a documented default at a boundary rather than a hidden dependency
deep inside behaviour.
`process.env` now survives in `src/` only as those default parameters —
nothing reads it at the point of use.
* style(cli): apply prettier formatting to the runtime observation command
Add the verify_managed_native_boundaries workflow for comparing authenticated inspect_managed_native_boundaries Evidence with supplied native export or function Evidence. The workflow verifies only P/Invoke declaration names against observed native symbols, keeps verified, inferred, contradicted, unresolved, and unsupported-native states explicit, and does not translate managed metadata tokens or RVAs into native addresses.
Expose schema-identical MCP and CLI surfaces, update managed workflow contracts, product catalog facts, TypeDoc output, README/localized docs, ADR status, package verification, and the REA analysis skill metadata for the 90-tool/50-command inventory.
Verification: npx vitest run tests/managedNativeVerification.test.ts --coverage=false; npm run typecheck; npm run docs:generate; npm run check (first run hit a load-sensitive sessionMcp timeout, isolated rerun passed); npx vitest run tests/sessionMcp.test.ts --coverage=false; npm run check; npm run knip; npm run jscpd; npm run scan:todos; npm run verify:managed; CXX=/usr/bin/g++-13 CC=/usr/bin/gcc-13 npm run verify:package.
Move Hopper loader derivation and compatibility projection into the Hopper adapter so BinaryTarget carries only provider-neutral identity and format metadata.
Introduce bounded canonical analysis-profile commitments, exact provider/profile snapshot v2 bindings, legacy snapshot rejection guidance, and backward-compatible profiled Evidence v2 records. Partition cache and replay behavior by target, concrete provider build, and profile while preserving custom Hopper loader overrides.
Propagate profiles consistently through CLI, MCP, composed workflows, and session lifecycle; preserve the 78-tool contract and legacy loaderArgs response projection. Add migration documentation, generated API updates, property regressions, package verification, and real Hopper coverage.
Derive package, tool-family, provider, setup-client, schema-version, and CLI facts from the runtime contract sources into a deterministic checked-in catalog.
Add non-mutating generated-file checks, exact TypeDoc regenerate-and-compare validation, caller-visible documentation fact checks, and CI enforcement through docs:check.
Cover command-router parity, source-derived catalog values, deliberate documentation drift, and stale generated artifacts while preserving runtime behavior.
Kaoru0822