Commit Graph
4865 Commits
Author SHA1 Message Date
morluto a004061abc fix(native): preserve provider limitations through call traces 2026-10-15 06:20:20 +08:00
morluto 01a1b3fda6 fix(ghidra): retain function boundary limitations on references 2026-10-15 06:20:20 +08:00
Ysopwnable 3d2846f237 fix(ghidra): invalidate synthetic entry reference snapshots (#3728)
fix(ghidra): exclude synthetic entry references
2026-10-15 06:14:29 +08:00
morluto bb49252523 test(ida): verify typed timeout and retained cleanup through the CLI 2026-10-15 05:38:36 +08:00
morluto 4946688c33 refactor(setup): distinguish provider configuration from registration settings 2026-10-15 05:23:04 +08:00
morluto 333e0ab0df fix(setup): propagate selected provider deadlines through CLI registrations 2026-10-15 05:16:08 +08:00
morluto c0cfccb45f fix(ida): preserve SDK request timeout identity and captured output 2026-10-15 05:14:57 +08:00
morluto dadf909dce fix(setup): derive MCP tool deadlines and preserve caller timeout choices 2026-10-15 05:05:24 +08:00
morluto 097a4bce6f fix(jeb): make upstream request deadlines configurable and preserve cancellation 2026-10-15 05:05:18 +08:00
morluto c831c23633 docs(mcp): clarify gateway schema recovery without inferring backend constraints 2026-10-15 04:49:27 +08:00
morluto 5a46fbacd5 fix(mcp): advertise explicit target cleanup when investigations finish 2026-10-15 04:49:27 +08:00
morluto 09e7f07108 fix(setup): select compact input schemas for Kimi registrations 2026-10-15 04:06:41 +08:00
morluto 1bbf4bd16c fix(process): preserve caller overrides during Windows environment normalization 2026-10-15 04:06:41 +08:00
morluto 07a501e82c fix(mcp): share inspection admission for prompt completion 2026-10-15 04:06:41 +08:00
morluto ebecf06f6e fix(setup): integrate Windows runner and ConPTY corrections 2026-10-15 04:04:17 +08:00
morluto 7e0c7b1244 fix(cutter): resolve bridge paths from the selected caller home 2026-10-15 04:01:36 +08:00
morluto 170bfc7b3f fix(mcp): authenticate inventory facts before prompt completion 2026-10-15 03:43:29 +08:00
morluto 591c87c4b6 refactor(artifacts): share inspection validation and prune legacy fixtures 2026-10-15 03:43:29 +08:00
morluto 9ac91e0c1e fix(artifacts): bind inspection provenance to every retained inventory 2026-10-15 03:43:29 +08:00
morluto 30a9139b87 fix(javascript): keep source-module semantics independent of sibling bytes 2026-10-15 03:43:29 +08:00
morluto a9588be4eb fix(evidence)!: reject missing recorded inventory and capture facts
BREAKING CHANGE: Inventory Evidence must explicitly report integrity_contradictions, and browser capture Evidence must report every resolved budget. Caller input defaults remain supported; stored observations are never filled with inferred defaults.
2026-10-15 03:43:29 +08:00
morluto fc789d19ff style(apple): normalize class parser module formatting 2026-10-15 03:43:29 +08:00
morluto 4ff2dadf66 refactor(apple): remove unused class identity re-export 2026-10-15 03:43:29 +08:00
morluto 1a06c82772 style(test): format coverage regression fixtures 2026-10-15 03:43:29 +08:00
morluto 57a23f0a2d fix(browser)!: expose capture budgets and queue admitted content reads
BREAKING CHANGE: Browser capture results require resolved limits, event families, and omission facts. Caller-selected budgets replace hidden retention ceilings; admitted content reads queue behind bounded concurrency.
2026-10-15 03:43:29 +08:00
morluto d2a53beb3d test(hopper): verify external exit recovery and retained ownership 2026-10-15 03:43:29 +08:00
morluto a8887a9a85 fix(jeb): probe live operations with owned discovery deadlines 2026-10-15 03:43:29 +08:00
morluto 45d5e80144 fix(cli): preserve Cutter choices and reject invalid runtime arguments 2026-10-15 03:43:29 +08:00
morluto 50dd9fcad1 fix(ghidra): preserve MIPS overrides and filter entry metadata 2026-10-15 03:43:29 +08:00
morluto 6add17a317 fix(windows): explain missing native artifacts and verify output drain 2026-10-15 03:43:29 +08:00
morluto 8c0e431895 fix(setup): own Hopper replacement staging and committed outcomes 2026-10-15 03:43:29 +08:00
morluto ceb77f6697 fix(apple): distinguish JVM resources and UIKit event connections 2026-10-15 03:43:29 +08:00
morluto fc7e41ff3b fix(process): attribute finite trace omissions and cleanup states 2026-10-15 03:43:29 +08:00
morluto cb4ff50202 fix(functions): preserve coverage diagnostics separately from blockers 2026-10-15 03:43:28 +08:00
morluto b47055edbe fix(javascript): preserve module identity and boundary fields 2026-10-15 03:43:28 +08:00
morluto 0405c9d361 fix(artifacts)!: authenticate complete inspection and summary inputs
BREAKING CHANGE: Artifact inventories require scoped coverage. Obsolete coverage_status and prose-based coverage inference are removed. Inspection carriers authenticate every retained inventory substep.
2026-10-15 03:43:28 +08:00
morluto db8128dc0d refactor(evidence)!: require current coverage commitments
BREAKING CHANGE: Evidence and analysis snapshots require explicit nullable relationship coverage and include it in their identity commitments. Historical records without the field are rejected; saved files are not migrated.
2026-10-15 03:43:28 +08:00
Swatantra Yadav 2abfe53dbd fix(setup): preserve overridden runner variables and test isolation on Windows
Support case-insensitive environment value lookup in ClientRegistrationIdentity while preserving JavaScript property order precedence with findLast(). Add unit regression coverage for ambient uppercase npm variables on Windows. Isolate USERPROFILE in cliSetup tests so child processes do not touch the host profile directory. Harden JSON decision extraction in runJourney against ConPTY trailing ANSI escape codes. Deterministically sequence multiselect prompt navigation before confirmation. Filter ambient runner variables case-insensitively before launching interactive setup completion tests.
2026-10-15 00:56:31 +05:30
qorvrandqorvr efbc486b9b fix(contracts): reject NUL bytes in keyed archive and extraction paths (#3606)
Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com>
2026-10-15 03:14:31 +08:00
11b747f29d fix(analysis-view): unify inert inline Evidence admission
Share inline Evidence admission before authentication across analysis views.
Reject executable object behavior before reflection, inspect arrays
incrementally, preserve inert JSON-omitted metadata and existing budgets.
Keep precise error locations with one bounded path stack.

Validated base failures, 48 source tests, 71 related public-boundary tests,
27 final CLI/MCP tests and eleven calls against a genuine Chromium HAR;
source identity, selected output and capacity accounting remain preserved.

Co-authored-by: Zhong-fan <205188959+Zhong-fan@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-15 03:13:28 +08:00
鸡哥 75104040df fix(javascript): track public CommonJS export receiver lifetimes (#3567)
* fix(javascript): track public CommonJS export receiver lifetimes

* fix(javascript): retain exports across uncertain identity effects
2026-10-15 02:46:14 +08:00
e79e014f23 fix(browser): preserve passive network inventory uncertainty
Preserve uncertainty in offline passive network comparisons when request
identity, metadata, or per-kind inventory coverage is incomplete. Retain
proven HTTP/WebSocket changes without using missing information to infer
membership, duplicate counts, or equality.

Compare redirect resource types only where both observations retain them.
Keep metadata completeness with its owner, stream HTTP content digests,
and require full coverage for multiplicity and WebSocket stream inventories.
Preserve independently known metadata changes and full-inventory counts.

Keep the original JavaScript configuration-escape, JSON, cancellation,
SAZ and schema-documentation fixes compatible with current main. Split
public CLI comparisons into isolated test cases without loosening timeouts.
Validate actual Chromium/HTTP captures through CLI and real stdio SDK,
with explicit limits and unchanged source bytes.

Co-authored-by: To3akaRin <131595336+To3akaRin@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-15 02:28:46 +08:00
morluto b8510ee00b test(mcp): remove cache and event order dependence from fault probes
Inject IDA diagnostic capacity faults per connection so prior module imports cannot bypass them. Use the CDP fixture event barrier before asserting complete body shapes, and document profile and renderer verification.
2026-10-15 01:41:31 +08:00
morluto 36615d9165 fix(mcp): honor Frida partial evidence retention acknowledgments
Use shared recorded-partial delivery on start, load and instrument errors. Return a retained reference only after a successful write; preserve the original inline partial when retention fails or is unavailable.
2026-10-15 01:41:31 +08:00
morluto c5fb86d194 fix(mcp): bind catalog identity to output schema profiles
Include the selected output advertisement profile while retaining canonical output validation in the identity. Reuse the SDK output projection and select doctor expectations from both profiles. Correct the compact input error documentation.
2026-10-15 01:41:31 +08:00
morluto 0df0e4f53e fix(contracts): honor options outside the schema projection cache
Bypass target-only memoization when Standard JSON Schema library options are supplied. Verify shared and inline projections remain independent in either call order.
2026-10-15 01:41:31 +08:00
morluto 204b9f3ac1 fix(contracts): preserve array guidance across MCP schema profiles
Keep item schemas when compact inputs reduce nested structure, expose literal tuple elements to items-first renderers, and preserve SQLite table-selection guidance across compaction. Verify catalog-wide client constraints and canonical rejection before dispatch. Document the stock Pi renderer size limit and caller-selected recovery.
2026-10-15 01:41:31 +08:00
Dery Ferdika a732c859dd fix(contracts): reject NUL bytes in Frida, Rizin, and GDB local path inputs (#3575)
Route the caller-selected local path fields in load_frida_script,
instrument_with_frida, start_frida_session, start_rizin_debug_session,
and start_gdb_session through the shared localPathStringSchema so a NUL
byte is refused at the advertised contract boundary instead of reaching
the filesystem or a provider subprocess and surfacing as a raw error.

Extend the OS-invalid-local-input acceptance harness to the tools that
were missing from it.
2026-10-15 01:17:54 +08:00
morluto 10aa74dfed fix(mcp): preserve tuple constraints in advertised schemas
Declare fixed tuple tails and lengths at the canonical boundary so client array validation accepts every tool. Preserve nonempty candidate constraints in managed and application comparisons. Add catalog-wide client checks and parser/schema parity coverage for both dialects and projection directions.

Fixes #3576
2026-10-15 01:12:46 +08:00
93e75bc8fe fix(setup): retain Hermes YAML scalar source during updates
Retain source nodes for unchanged scalar values and string keys when
replacing a Hermes registration. Discarding quoted YAML 1.2 keys could
make Hermes' C reader reject duplicate boolean keys and switch to the
pure reader, changing the interpretation of unrelated settings.

Use linear mapping lookup, quote newly created YAML 1.2 strings for
YAML 1.1 compatibility, and preserve direct numeric edit formatting.
Extend actual CLI coverage for both existing reader-selection directions;
verify strings, exact unrelated numeric/timestamp values, backups and
idempotence with the actual Hermes Python loader.

Follow-up to #3102 and main's independent Hermes scalar fix.

Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-15 00:57:57 +08:00