* ci: run required checks on merge-queue groups
Add the merge_group trigger to CI and PR title validation so every required
check reports on the queued group's exact head. Group runs use exact-head
concurrency groups that pushes cannot cancel, classify the group's combined
diff from its base (a non-ancestor base fails planning), and keep the CI
required gate running when a group is cancelled so it fails instead of
reporting a skipped check. Title validation checks every squash commit
subject between the group base and head.
* ci: read the merge-group comparison from a file
Every counted-baseline change edited scripts/verify/architecture-guard-baselines.json, so PRs touching unrelated guards conflicted there. Each guard now keeps its baseline in scripts/verify/baselines/<guard-key>.json with paths sorted by code unit; --shrink-baselines rewrites, and deletes a guard's file when its last count is removed, and the guard rejects unsorted files and files that name no counted guard.
summary.json held every advertised pattern's site list and every tool's
schema digests in one file. Each new path-taking tool appended to the
shared path pattern's list, so concurrent tool PRs conflicted on it, and
updating it required a local build.
Each tool's digests and patterns now live in
scripts/verify/advertised-schemas/tools/<tool>.json. The check still prints
aggregated review lines such as "N tool schemas gained pattern /.../", and
on failure also prints the expected contents of each missing or stale file
so a PR can commit them from CI output without building. --update-summary
writes those files and deletes summaries of removed tools. The existing
summary was split into per-tool files from its recorded data.
Fixes#11189
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): re-emit advertised patterns in a portable regex grammar
* fix(mcp): present discover_tools input through the selected profile
The hot-cold catalog registered discover_tools directly with the SDK, so
the default compact input profile still advertised its canonical schema,
including page-size defaults clients apply on their own (#5322). Route
every listed input schema, transport discovery included, through one
server-owned presentation, and pass the selected presentation to the
deferred server, which serves recorded tool schemas but not discovery.
* fix(mcp): keep the Evidence union on described borrowed inputs
borrowEvidenceInput installed its advertised projection on one schema
instance. A call site's .describe() rebuilds the schema from its
definition, so match_native_functions advertised left and right as
unconstrained values in every input profile. Install the projection in
the borrowed parser's constructor so derived schemas keep it, for both
borrowed inputs and borrowed arrays.
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): preserve schema widening through references
* feat(mcp): project compact input schemas into the portable advertised dialect
One projection (advertisedDialectProjection.ts) owns the compact input
advertisement: one type per node, items on every array, string literals
as enums, oneOf widened to anyOf, allOf merged, tuples as element unions,
exclusive bounds made inclusive, and every keyword outside the dialect
dropped. Each rewrite is exact or widening; server validation is
unchanged. The root description and sentences for dropped cross-field
constraints move to the tool description, which Codex and Zed keep.
The compact baseline falls to nullable values only (29), which the
dialect cannot express without narrowing an input. The gateway shape
repairs (typeArrayItemUnions, hasGatewayIncompatibleShape), the second
dependentRequired-to-prose copy and the strict-gateway test denylist are
removed; the dialect checker gates the inline presentation instead.
* feat(mcp): omit output schemas from tools/list by default
No surveyed model API reads an output schema, MCP client validators
repeat REA's own result validation, and complete output schemas were
about 92% of the default tools/list. REA_MCP_OUTPUT_SCHEMA_PROFILE now
resolves to off through one owner (resolveMcpOutputSchemaProfile);
compact and full remain selectable. structuredContent is still
delivered, and the deferred server serves both off and full from the
recorded catalog with the matching recorded identity.
Tests and artifact verifiers that validate results against complete
advertised output contracts select full explicitly.
* docs: describe omitted output schemas as the default in README translations
* fix(mcp): select schemas in verification workflows
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* fix(mcp): keep projected schemas permissive
* fix(mcp): keep references valid when presentation widens their targets
* fix(mcp): keep a single union branch's closure scoped to its properties
* fix(mcp): select complete output schemas in the Electron verifier
* fix(mcp): select complete output schemas in standalone verifier probes
* fix(mcp): keep an allOf member's tuple tail with its own positions
* fix(mcp): relax references into negations and conditionals presentation may remove
* refactor(contracts): declare root discriminators as typed schema annotations
* test(mcp): select the borrowed Evidence contract from its family
* fix(mcp): keep astral literals and dynamic references widening in every mode
* fix(mcp): omit astral literals and relax untracked references when presentation widens
* fix(mcp): select complete output schemas in every verifier transport
* fix(mcp): read reference pointers by schema position, not segment spelling
* fix(mcp): protect references into collapsing boolean unions and keep referencing branches out of the collapse
* fix(mcp): keep reduced schemas open when their root admits names by pattern
* test(mcp): keep the reduced-schema pattern case outside the size-limited block
* fix(mcp): omit patterns whose classes name astral characters
* fix(mcp): decide union collapse and pointer protection from canonical branches
* docs(mcp): document non-u astral matching and pin BMP agreement across V8 modes
* fix(mcp): keep prototype-named properties as own properties in the dialect projection
* test(mcp): select full output schemas in packet and signal schema checks
* test(mcp): expect the advertised base64 schema to omit the unbounded pad-bit probe
* fix(mcp): protect references into unevaluated keywords lost evaluation removes
* fix(mcp): validate the doctor probe reply against the canonical output contract (#10655)
* fix(mcp): validate the doctor probe reply against the canonical output contract
* test(mcp): replay doctor probe validation under every output profile
* test(mcp): accept typed-branch nullable unions in the advertised dialect (#10649)
* test(mcp): select full output schemas in HTTP session workflows
* fix(mcp): emit stack-safe classes with non-ASCII members and protect draft-07 reference siblings
* fix(mcp): protect references into literal siblings of relaxed draft-07 references
* feat(mcp): omit output schemas from tools/list by default (#10646)
* feat(mcp): omit output schemas from tools/list by default
No surveyed model API reads an output schema, MCP client validators
repeat REA's own result validation, and complete output schemas were
about 92% of the default tools/list. REA_MCP_OUTPUT_SCHEMA_PROFILE now
resolves to off through one owner (resolveMcpOutputSchemaProfile);
compact and full remain selectable. structuredContent is still
delivered, and the deferred server serves both off and full from the
recorded catalog with the matching recorded identity.
Tests and artifact verifiers that validate results against complete
advertised output contracts select full explicitly.
* fix(mcp): select schemas in verification workflows
* fix(mcp): select complete output schemas in the Electron verifier
* fix(mcp): select complete output schemas in standalone verifier probes
* fix(mcp): select complete output schemas in every verifier transport
* test(mcp): select full output schemas in packet and signal schema checks
* fix(mcp): validate the doctor probe reply against the canonical output contract (#10655)
* fix(mcp): validate the doctor probe reply against the canonical output contract
* test(mcp): replay doctor probe validation under every output profile
* test(mcp): accept typed-branch nullable unions in the advertised dialect (#10649)
* test(mcp): select full output schemas in HTTP session workflows
* fix(mcp): keep the Evidence union on described borrowed inputs (#10597)
* fix(mcp): keep the Evidence union on described borrowed inputs
borrowEvidenceInput installed its advertised projection on one schema
instance. A call site's .describe() rebuilds the schema from its
definition, so match_native_functions advertised left and right as
unconstrained values in every input profile. Install the projection in
the borrowed parser's constructor so derived schemas keep it, for both
borrowed inputs and borrowed arrays.
* test(mcp): select the borrowed Evidence contract from its family
* docs(mcp): admit baseline growth only for restored contract declarations
* fix(mcp): state reduced multi-type properties as typed branches, not type lists
The reduced fallback derived a property's types and emitted them as a type
list, which Gemini, Moonshot and Ark reject. A property whose canonical
schema is anyOf string and number therefore traded a typed union for a
rejected construct when the inline projection fell back. Emit one type, or
anyOf typed branches, so [T, null] becomes the dialect's nullable union.
* feat(mcp)!: retire the full schema profiles and declare complete observations as a typed annotation (#10718)
* refactor(mcp): declare complete observations as a typed annotation applied only on the wire
* test(mcp): compare complete-observation declarations with their owning text
* refactor(schema): couple Zod checks with their JSON Schema constraint keywords (#10725)
* refactor(schema): couple Zod checks with their JSON Schema constraint keywords
* refactor(schema): declare pattern approximations and object output roots as typed annotations (#10754)
* refactor(schema): declare pattern approximations and object output roots as typed annotations
* fix(schema): refuse pattern declarations JSON Schema cannot state
* test(schema): select guided_workflows from its contract family
* feat(mcp)!: retire the full input and output schema profiles (#10841)
* feat(mcp)!: retire the full input and output schema profiles
The compact input presentation is now the only advertised input schema, and
output schemas are either omitted (`off`, the default) or bounded
(`compact`). Catalog identity, the build-recorded digests and the recorded
startup catalog collapse to those presentations: two digest profiles instead
of six, one recorded catalog instead of two, and no input dialect baseline.
Tests and verifiers that validated replies against listed full output
schemas now validate against the canonical output contract, which REA
already enforces server-side; tests that asserted canonical input
restrictions read the canonical input schema instead of a full listing.
BREAKING CHANGE: `REA_MCP_INPUT_SCHEMA_PROFILE=full` and
`REA_MCP_OUTPUT_SCHEMA_PROFILE=full` are refused at startup and by `rea setup`
with a configuration error naming the setting. Remove the setting from the
client registration (or rerun setup with `REA_MCP_INPUT_SCHEMA_PROFILE=compact`
/ `REA_MCP_OUTPUT_SCHEMA_PROFILE=compact`). `REA_MCP_INPUT_SCHEMA_PROFILE`
still accepts `compact`. Server-side validation is unchanged.
* test(mcp): validate replies against canonical output contracts at every listed-schema reader
tools/list omits output schemas by default, so fixtures, verifiers and the
Android analysis runners that read a listed outputSchema now bind the
canonical contract instead. connectLocalToolsMcp and advertisedMcpToolSchemas
hand the SDK a definition carrying the canonical output schema, so the SDK
client and caller-supplied validators check every successful reply.
* test(mcp): resolve Android runners' output contracts from the selected repository
The Android efficiency runners imported the canonical output-schema helper from the harness checkout while --repository selects the revision under test. Import it from the selected repository, as the runners already do for the SDK and Ajv.
* test(mcp): let Android runners compare revisions before the canonical output helper
A selected revision without scripts/lib/canonical-output-schema.mjs could not start the Android runners. Choose the output contracts in one harness helper: the selected revision's canonical contracts when it has them, otherwise its listed schemas under the full output profile it still supports.
* fix(scripts): keep caller launch settings when the real Hopper verifier builds its server environment
The verifier deleted REA_VERIFY_SERVER_COMMAND and REA_VERIFY_SERVER_ARGS_JSON from process.env itself before reading them, so a caller selecting an installed REA command silently ran the checkout's dist/main.js. Copy the environment, as main does, so only the child's environment changes.
* test(mcp): validate whole replies against canonical output contracts wherever a listed definition is held
tools/list omits output schemas by default and the full output profile is gone, so tests that handed the SDK a listed definition no longer checked complete replies. Attach the canonical output schema with withCanonicalOutputSchema at every held REA tool definition. Environment-served tools (not REA contracts), and the deferred-runtime and doctor tests that exercise per-profile listings, keep their listed definitions.
* test(mcp): record the advertised catalog summary without the retired full profiles
Retiring the full input and output profiles leaves only the compact input and compact output listings, so the summary drops the full-profile digests and every pattern only the full listings carried. Regenerated with npm run verify:advertised-schemas -- --update-summary.
* ci(guards): run the architecture guards in the pre-push check
* docs(limits): name lint as the numeric-limit check's owner
* ci(lint): cache the numeric-limit check by every file its restart-field scan reads
* test(mcp): compile advertised patterns with the regex engines clients run
List the built package's tools over stdio in every input, output and
catalog profile and compile each distinct advertised regular expression
with V8 (plain, u, v), Go regexp (RE2), C++ RE2, Python re, and Rust regex
and fancy-regex through the Rust jsonschema crate. A refusal names the
engine, its error, and each tool, schema path and profile.
The Python engines are pinned, hash-checked wheels; Go is the host
toolchain with GOTOOLCHAIN=local. A missing engine is reported as not
verified, and REA_REQUIRE_SCHEMA_ENGINES=1 makes it a failure.
The pattern owner now also reports patternProperties keys, which clients
compile as well.
Refs #10830
* test(mcp): run schema engine helpers and listings under the process owner
* test(mcp): load advertised schemas in the validators clients build (#10983)
* test(mcp): load advertised schemas in the validators clients build
Build a validator for every distinct advertised input and output schema
with the Rust jsonschema crate's defaults, which check the declared draft's
meta-schema and formats and compile every subschema. --complete adds Python
jsonschema's check_schema, which jsonschema.validate runs in Python clients;
it takes several seconds, so it is opt-in.
Refusals are grouped by reason, so one shared pattern that breaks many
schemas is reported once with its sites.
Ajv strict mode and OpenAI strict mode are documented as not covered, with
the reasons.
Refs #10830
* ci(mcp): require the client schema engines on every code change (#10984)
* ci(mcp): require the client schema engines on every code change
Run scripts/verify-advertised-schemas.mjs at the end of the build job, after
its artifacts upload, with REA_REQUIRE_SCHEMA_ENGINES=1 so a missing engine
fails rather than passes. Go is the runner's toolchain; the Python engines
install into a virtual environment cached by the requirements file's digest
and interpreter version. Full qualification adds --complete.
Refs #10830
* test(ci): require the client schema engine step in code builds
* test(mcp): record a reviewable summary of the advertised catalog (#10985)
* test(mcp): record a reviewable summary of the advertised catalog
Commit scripts/verify/advertised-schemas/summary.json: each advertised
pattern with the tool schemas that carry it, and a digest of every tool's
schema per input or output profile. The advertised schema check compares it
with the packaged listings it already makes and fails on any difference,
printing lines such as '119 tool schemas gained pattern /.../', so a change
that reaches many tools at once is visible in review.
--update-summary regenerates it.
Refs #10830
* docs(release): check the packed catalog with client engines before publishing (#10986)
* docs(release): check the packed catalog with client engines before publishing
Add a pre-publish step to the release guide: install the packed candidate
into an empty prefix and run verify-advertised-schemas.mjs against it with
--package-root, requiring the RE2 (Go regexp and C++ RE2) and Rust (regex,
fancy-regex and jsonschema) engines. CI checks each commit's build; this
covers the archive that will be published.
Refs #10830
* docs(release): check the exact qualified archive and clean up afterwards
* test(mcp): regenerate the advertised catalog summary from current main
* perf(mcp): advertise large output union alternatives as shared definitions
inspect_analysis_view's advertised output schema held every view result inline in one union definition, which the MCP SDK's default validator compiled into one function: about 1.7 s CPU and 500 MiB peak. Large union alternatives now become definitions of their own and identical definitions are merged, at the owning output projection. Tests that check results against the advertised output contract now compile that schema instead of a separate inline projection, which overflowed the main-thread stack under forked workers.
* perf(tests): run source test projects in forked workers (#11016)
Thread workers of the source lane share one process, which grew to 3.8-5.0 GiB; forked workers keep each heap separate so the largest process stays near 1.2-1.8 GiB.
* test(mcp): select the analysis view contract from its family
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): re-emit advertised patterns in a portable regex grammar
* fix(mcp): present discover_tools input through the selected profile
The hot-cold catalog registered discover_tools directly with the SDK, so
the default compact input profile still advertised its canonical schema,
including page-size defaults clients apply on their own (#5322). Route
every listed input schema, transport discovery included, through one
server-owned presentation, and pass the selected presentation to the
deferred server, which serves recorded tool schemas but not discovery.
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): preserve schema widening through references
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* fix(mcp): keep references valid when presentation widens their targets
* fix(mcp): relax references into negations and conditionals presentation may remove
* fix(mcp): keep astral literals and dynamic references widening in every mode
* fix(mcp): omit astral literals and relax untracked references when presentation widens
* fix(mcp): read reference pointers by schema position, not segment spelling
* fix(mcp): protect references into collapsing boolean unions and keep referencing branches out of the collapse
* fix(mcp): omit patterns whose classes name astral characters
* fix(mcp): decide union collapse and pointer protection from canonical branches
* docs(mcp): document non-u astral matching and pin BMP agreement across V8 modes
* test(mcp): expect the advertised base64 schema to omit the unbounded pad-bit probe
* fix(mcp): protect references into unevaluated keywords lost evaluation removes
* fix(mcp): emit stack-safe classes with non-ASCII members and protect draft-07 reference siblings
* fix(mcp): protect references into literal siblings of relaxed draft-07 references
* fix(mcp): keep the Evidence union on described borrowed inputs (#10597)
* fix(mcp): keep the Evidence union on described borrowed inputs
borrowEvidenceInput installed its advertised projection on one schema
instance. A call site's .describe() rebuilds the schema from its
definition, so match_native_functions advertised left and right as
unconstrained values in every input profile. Install the projection in
the borrowed parser's constructor so derived schemas keep it, for both
borrowed inputs and borrowed arrays.
* test(mcp): select the borrowed Evidence contract from its family
* docs(mcp): admit baseline growth only for restored contract declarations
* refactor(providers): finalize apktool and shared artifact resources through runOwned
runOwned moves to the provider layer so provider sites can use it without depending on application workflows. It gains a completed-value projection (partial) for values that are not themselves partial observations, an optional signal, and cleanupLeases that bind a close failure to the exact leases whose confirmed release resolves it.
ArtifactAnalysisResources.finish is removed; TShark and sigrok finalize through runOwned with the shared release as close. Apktool's hand-written release, cancellation and lease-group composition is replaced by runOwned. A failed primary now keeps a cancellation observed during final cleanup as a secondary failure, as the documented precedence requires.
A counted architecture guard refuses new hand-written completed-result abort reclassification outside runOwned.
* refactor(adb): finalize runtime-root work through runOwned (#10660)
* refactor(adb): finalize runtime-root work through runOwned
The ADB runtime-root finalizer re-derived the precedence by hand and kept its own cancellation-with-cleanup combiner. It now runs through runOwned: the work body maps snapshot failures, close releases the root lease and binds its own cleanup error, and partial projects the completed execution. A cancellation whose cleanup fails is now the shared cleanup composite with the cancellation as its primary, as runOwned produces for every other owner.
* refactor(providers): keep completed values as diagnostics in runOwned and migrate four finalizers (#10691)
* refactor(providers): keep completed values as diagnostics in runOwned and migrate signature, Ghidra, bundle and LLDB finalization
* test(providers): run the lifecycle scenarios over every runOwned adopter shape (#10707)
One table of testing.md lifecycle rows runs over partial, diagnostics, publishing and lease adopters, replacing the hand-written precedence cases it covers.
* chore(lint): move runOwned's classifier baseline entry with the file
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): re-emit advertised patterns in a portable regex grammar
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): preserve schema widening through references
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* fix(mcp): keep references valid when presentation widens their targets
* fix(mcp): relax references into negations and conditionals presentation may remove
* fix(mcp): keep astral literals and dynamic references widening in every mode
* fix(mcp): omit astral literals and relax untracked references when presentation widens
* fix(mcp): read reference pointers by schema position, not segment spelling
* fix(mcp): protect references into collapsing boolean unions and keep referencing branches out of the collapse
* fix(mcp): omit patterns whose classes name astral characters
* fix(mcp): decide union collapse and pointer protection from canonical branches
* docs(mcp): document non-u astral matching and pin BMP agreement across V8 modes
* test(mcp): expect the advertised base64 schema to omit the unbounded pad-bit probe
* fix(mcp): protect references into unevaluated keywords lost evaluation removes
* fix(mcp): emit stack-safe classes with non-ASCII members and protect draft-07 reference siblings
* fix(mcp): protect references into literal siblings of relaxed draft-07 references
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
- doctorCancellation measured from the signal, after the probe had
started, so a probe stopped by its own deadline could still pass. The
fake probe now records its start, and the check runs from there.
- rea/project-wait-deadline missed literal computed `timeout` keys and
spread options. It now reports both, as well as computed keys it
cannot read.
- The testing guide notes that a long-running test's expect.poll keeps
its project budget, while waitFor follows the tag's deadline.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Vitest's expect.poll and vi.waitFor stop after one second by default, a
host-speed guess that the project's deadline policy does not see. Under
hosted-CI load, kunaProjectConcurrency failed that way twice on unrelated
PRs. Another 256 waits relied on the default, and 97 passed literals
picked to fit some host.
Waits now take as long as their test may run, less the reporting reserve
that children already keep. Each Vitest project sets expect.poll's
default, and the new waitFor in tests/support/testWait.ts replaces
vi.waitFor. Fixture readiness waits (awaitAcknowledgement and the provider
process waits) default to the same deadline, and their host-speed literal
arguments are removed. One remainingTestDeadline owns the arithmetic for
both children and waits.
Ten waits whose short timeout was the real check now assert it directly
(Kuna version probe, Cutter discovery, doctor and Inspector cancellation,
apktool fixture teardown, JADX disconnect): settlement before the
production deadline that would otherwise also satisfy the wait, or a
deadline pinned beyond every test deadline.
The rea/project-wait-deadline lint rule rejects vi.waitFor and explicit
expect.poll timeouts. The testing guide and the CI tests audit skill now
document the policy.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
The testing guides stated lane and shard counts in prose. The counts drifted
when the workflow changed: "all eight fast built shards" survived the move to
twelve, "Eight Linux real-system lanes" now covers twelve workflow calls, and
the SQLite guide named a Node 24.15.0 lane that the matrix no longer runs.
Describe each set by its selector and point at the workflow that owns the
exact versions, so later workflow changes cannot make the text wrong.
Fixes#7616Fixes#7617
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Across 29 successful runs, the slowest of eight shards ran 24% above the
mean shard (797 s against 646 s), with no shard index consistently slow:
duration-balanced shards still vary with hosted runner speed. Resampling
the observed per-shard speed factors predicts the slowest of twelve
shards at about 9.2 minutes instead of 13.2, for roughly 5% more runner
time.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* refactor(cli): run one-shot commands through one shared owner
scripts/rea.mjs and the test CLI session worker each implemented the
one-shot command sequence: argument normalization, output admission,
configuration errors, version documents, the Amp scope refusal, and
result delivery. The worker copy had drifted: it never rendered
formatted version reports or the Amp refusal.
Move the sequence into src/cliOneShot.ts. Both callers supply a host
for their streams, exit and resource ownership. The launcher keeps
closed-pipe status, worker shutdown and process exit; the session
worker captures output per command.
The cliOutput bundle entry is superseded and removed. The dispatcher
test now replaces only the command runtime, so output admission runs
production code. A new parity test compares the file session with a
fresh process.
* test(cli): bundle the one-shot entry in the runtime bundle fixture
* perf(tests): run plain CLI commands on the file's shared process
`cli.run` in `cliTest` files started a fresh compiled CLI for every
command, about 0.45s and 260 MB each before any work. The file-scoped
session already existed, but callers had to opt in through
`runFileCli` or `sharedCliRun`, so 1,300 call sites still spawned.
Make the fixture choose: `cli.run` uses the shared process when it
reports the command exactly as a fresh process would, and starts one
otherwise (stdin, explicit deadlines, MCP and MCP doctor routing,
NODE_OPTIONS, or enabled logging). `freshProcess: true` keeps
explicit process-level checks. The session worker now presents the
launcher's entrypoint, so registration identity matches a fresh
process.
`runFileCli` and `sharedCliRun` are superseded and removed; their
call sites use `cli.run`, and paired fresh/shared checks use
`freshProcess`.
* style(tests): format the managed member summary call site
* test(cli): give each shared-session command an empty stdin
The shared CLI process reads session frames from its own stdin. A
command that reads stdin without supplied input, such as
`compare-wasm-interfaces - --json`, read that pipe and hung, where a
fresh process receives EOF. The worker now presents an ended, empty
stdin to each command and restores its own afterwards.
The parity test compared the routed path with itself after cli.run
began choosing the session. It now compares a fresh process with the
session directly, including the `mcp add` refusal and a command
reading absent stdin.
* test(cli): keep default command logging and launcher checks on fresh processes
environment-serve and environment-build log at info when REA_LOG_LEVEL is
unset, through a logger that writes to stderr directly. The shared CLI
process captures only process.stderr writes, so routed runs lost those
lines. Declare the default-logging commands beside the command names,
have infoLogger read that set, and start a fresh process for them.
The log-level precedence checks compared the shared process with itself
after routing; their fresh side now passes freshProcess: true.
Registries created directly with createTestProcessRegistry did not get the
processTest default, so a hung child there had no deadline once its explicit
value was removed; Vitest's test timeout does not settle the awaited run, so
shutdown was never reached. Derive the default in the registry from the
running test instead, using the real clock.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A processTest child run without its own timeoutMs now gets the test's
remaining deadline less a reporting reserve (at least 5 seconds, or a
tenth of the deadline). A hung child still fails with its captured output,
without a fixed per-call value that assumes a host's speed.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(ci): move dated shard measurements into a verification record
The testing guide and testing-lanes guide mixed the October 2026 shard
budget and stale-history measurements into current rules. Move them to
docs/verification/ci-shard-scheduling-2026-10-20.md and link it from
the rules they justify.
* docs(ci): drop dated shard measurements instead of keeping a record
Probes in a source and a built project read each collected test's
deadline, including test, suite, and module long-running tags, so a
change in project inheritance or tag resolution fails directly. Both
the policy and the probes read one set of base deadlines.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Source projects allow 30 seconds and built projects 120 seconds, both
doubled under coverage, and hooks share their project's deadline instead
of Vitest's 10-second default. A long-running tag covers bounded
workloads that need more.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(javascript): give the wide fingerprint regression a capacity deadline
Each case runs about 22 s of CPU-bound projection on a typical hosted
runner. Its explicit 30 s deadline failed on slower runners at both two
and four Vitest workers, and it also overrode the suite's 60 s
coverage-mode allowance.
* test(ci): double test deadlines on hosted runners
Hosted CI jobs run four Vitest workers on a four-core runner. CPU-bound
capacity cases then share every core with other workers and their
subprocesses; three such cases exceeded the 30 s deadline at four
workers (16.8-22.7 s at two). The deadline only needs to bound a hang,
so hosted CI doubles it: 60 s, or 120 s with coverage. Local runs keep
30 s and 60 s.
* test(ci): check worker and deadline policy for local and hosted runners
The policy test loaded vitest.config.ts in a child that inherited the
parent's GITHUB_ACTIONS, so on CI it observed the hosted deadlines and
failed. Select the runner explicitly and check both: two workers and the
base deadline locally, four workers and twice the deadline on hosted CI.
Hosted CI jobs own a four-core runner but the suite ran on two workers.
Other hosts keep the two-worker bound because they are shared.
Co-authored-by: Claude Fable 5.2 <noreply@anthropic.com>
* docs: organize canonical documentation layout (URGENTE)
Group all existing authored guides by domain and ownership, expose complete navigation, and preserve their public routes. Update physical path consumers and release configuration while retaining historical records. Document domain-based specs and ADR slugs without global numbering.
Co-Authored-By: Codex <noreply@openai.com>
* fix(docs): honor home layout in all-page route verification
* style: format reviewed source changes
* fix(docs): preserve routes and navigation cache inputs
* fix: repair the static-check failures on the default branch (#2895)
* fix: repair the static-check failures on the default branch
The default branch fails its own required `Static checks` job three ways, so
every pull request reports that job as failed regardless of its own change.
- `npm run format:check` reports `src/domain/functionComparison.test.ts` and
`src/ida/IdaOperationRunner.ts`.
- `npm run lint` reports a duplicate `import { join } from "node:path"` in
`tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17).
- `npm run typecheck` reports `format: "devin"` missing from the client format
union in `src/application/SupportedClients.ts`, and an unchecked index in
`tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is
inferred as `string[][]`.
Apply the pinned formatter, drop the duplicate import, list the `"devin"` format
that its own definition already uses, and mark the pair array `as const`.
Validation: `npm run check:fast` and `npm run format:check` pass.
* fix(setup): keep Devin on the JSON configuration dialect
---------
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(docs): update links after guide relocation
* docs: correct verified documentation route counts
* fix(docs): update browser capture guide link after move (#2820)
Refresh gettext protected-link comments alongside the authored href.
Co-authored-by: Codex <noreply@openai.com>
* fix(docs): include http3 lab in stable routes
* fix(docs): preserve historical release evidence and links
* fix(ghidra): restore Windows verifier identity import
* docs(wakaru): preserve pinned upstream policy link
* docs(index): retain recently added guide links
* docs(mcp): preserve parent retention clarification
* fix(cli): preserve standalone import guidance
* fix(test): preserve translated guide link drift coverage
---------
Co-authored-by: Matheus Breguêz <matbrgz@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: morluto <17176810+morluto@users.noreply.github.com>
Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com>
Co-authored-by: 吴佳浩 <wujiahao@supremind.com>
morluto