* fix(firmware): keep producer reports writable under small staging budgets
extract_firmware passed max_output_bytes straight to prlimit --fsize. RLIMIT_FSIZE
applies to every regular file the producer writes, including the mandatory
report.json and unblob.log outside the staging tree, so a staging budget smaller
than the report truncated it and failed the extraction even when every staged
file fit. Derive the per-file ceiling as the larger of the staging budget and the
8 MiB report budget; polling and the final inventory still enforce the aggregate
staging budget.
Fixes#3888
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(firmware): keep files stopped at the size ceiling over budget
The per-file RLIMIT_FSIZE ceiling equalled the largest size its readers
accept, and both the staging inventory and the report reader accept a
file of exactly their budget. A write the kernel stopped at the ceiling
therefore left a truncated file that passed as complete. Raise the
ceiling by one byte so such a file exceeds its budget and is rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(firmware): report the effective file-size ceiling on limit failures
The exit path re-derived the staging budget for SIGXFSZ and process-limit
recovery, so a small-budget run killed at the 8 MiB + 1 ceiling reported
file_size_bytes 64 and said the cap was max_output_bytes. Pass the
ceiling runFirmwareCommand installs and describe how it is derived.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(firmware): reject staged files cut off at the per-file limit
RLIMIT_FSIZE stops a write at the limit without extending the file, and
the staging inventory admits a file of exactly max_output_bytes. With a
budget of 8 MiB or more the producer limit equalled the budget, so a
staged file the kernel cut short published as a complete extraction;
an inherited ceiling below the budget did the same.
Derive the per-run limit once in firmwareFileSizeLimit as one byte above
the largest budget, still capped by the inherited ceiling, so a file
stopped at the limit exceeds its budget. When the inherited ceiling
removes that byte, both staging inventories refuse a regular file that
reaches the installed limit with a nonretryable file-size constraint
naming the inherited limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(firmware): derive limit adjustability from the per-run limit
The one byte of headroom makes the per-run file limit equal an
inherited ceiling of exactly max_output_bytes + 1, but adjustability
still compared that ceiling with the raw budget. A SIGXFSZ then advised
raising max_output_bytes, which the same ceiling clamps back to the
same limit.
Decide adjustability in firmwareFileSizeAdjustable from
firmwareFileSizeLimit itself: recommend a larger budget only when it
raises that limit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(firmware): compare file-size recovery with its owners
The SIGXFSZ adjustability cases and the inherited-ceiling workflow matched
fragments of remediation prose, so a harmless rewrite would fail them.
Compare the emitted guidance with firmwareSignalLimitError for the expected
branch, check that the two branches stay distinct, and compare the inventory
refusal with firmwareFileSizeLimitReached. The selected limit, resource and
retryability stay asserted as structured facts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Hash the complete oversize fixture through a read stream rather than allocating the entire 128 MiB file. Preserve the digest and oversize admission test semantics.
Validation: node --check and full static checks pass. The capacity fixture was not rerun locally to avoid heavy work.
Based on #1892.
Co-authored-by: GRAB Racem <racem.grab@etu.univ-lyon1.fr>
* fix(firmware): accept the verified Binwalk and Unblob release lines
Exact --version equality rejected every build except Binwalk 3.1.0 and
Unblob 26.6.4, then stored that constant as the observed engine version.
Admit the 3.1 and 26.6 lines, keep the audited build as verified, and
report the banner that actually ran.
* chore(docs): regenerate skill metadata after firmware contract text
docs:check failed because SKILL.md lagged the Binwalk/Unblob release-line
tool descriptions.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
