mirror of
https://github.com/morluto/rea.git
synced 2026-11-09 16:26:36 +00:00
8c64eb511fd59bbd8ef09ff761323ffa3eeb2908
2281
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 morluto
|
a874cef9af | fix(adb): report observed output after failed file pull (#9596) | ||
|
morluto
|
9536ebb7ca |
fix(firmware): exclude UF2 payloads overlapping MD5 metadata (#9593)
* fix(artifacts): exclude UF2 payloads overlapping MD5 metadata * fix(artifacts): clarify DfuSe overlap ordering |
||
|
2SinceJulyand2SinceJuly
|
ca456efcbf |
fix(wasm): admit compatible 1.0.x WABT releases (#9223)
* fix(wasm): admit compatible 1.0.x WABT releases REA_WABT_BIN_DIRECTORY admission compared each --version banner to the literal 1.0.42, so a Homebrew or rolling-distribution WABT that advanced past that build was refused even though wasm-validate, wasm-objdump and wasm2wat accept the same flags and emit the same output shape. Callers had to keep a hand-extracted 1.0.42 tarball alongside the system package. Admission now accepts the release range ^1.0.42 and records the observed banner, matching how the Wakaru adapter already admits compatible builds. The verified release stays the reference: a banner other than 1.0.42 is retained as tool_profile.release and provider.version and the report states that only 1.0.42 was verified. All three tools must report the same release, since one directory is one installation. Managed downloads stay pinned. Fixes #9197 * fix(wasm): bound WABT admission to releases the report schema accepts WABT_ACCEPTED_RANGE was "^1.0.42", which also admits 1.1.0 and later 1.x releases, while wasmArtifactSchema only accepts 1.0.x banners. A configured tool reporting 1.1.0 therefore passed version admission, ran the inspection, and then failed at report parsing. Use the explicit ">=1.0.42 <1.1.0" range so admission and the schema agree, and test the boundary. Also carry the compatible-release warning into both partial-Evidence builders. Previously only successful reports stated that REA verified 1.0.42, so a validation rejection or later read failure under a compatible release silently dropped the uncertainty that a success reports. Share the text through wabtReleaseLimitation so both paths stay aligned. * fix(wasm): stop claiming the 1.0.42 commit for a newer admitted release A caller-supplied 1.0.43 or 1.0.44 was admitted with the observed banner in tool_profile.release, but source_commit still carried the 1.0.42 revision, which is a claim about a build that did not run. Emit null for any release other than the verified 1.0.42; the observed release and each executable digest still identify what actually ran. Also spell the accepted range as it is defined (>=1.0.42 <1.1.0) in the guide and the failure fixture instead of ^1.0.42, which in semver admits 1.1.0. --------- Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com> |
||
|
Rishikesh Gowda K K
|
891371e738 |
fix(objdump): reflect observed launch failure in discovery availability (#9051)
* fix(objdump): reflect observed launch failure in discovery availability Distinguish a statically registered standalone command from an executable whose launch has failed in the active server session. Discovery leaves unprobed commands optimistically available, reports an observed launch failure as provider_unavailable with the command remediation, keeps the tool callable for retries, and clears the failure after a subsequent successful launch. Fixes #8826. * test(reverse): verify overlapping command launch dispatch ordering * test(reverse): unblock gated test workers before awaiting service closure * test(reverse): bound lifecycle acknowledgement and join launched workers * fix(reverse): distinguish host capacity exhaustion from command launch failures * fix(reverse): preserve host capacity across Linux process ownership preparation * fix(reverse): exclude process ownership admission failures from command launch state * fix(reverse): preserve Darwin process ownership preparation error across command launch * fix(reverse): disambiguate cleanup declaration in provider observation * fix(reverse): preserve command deadline timeout during Darwin ownership preparation * fix(reverse): isolate Darwin baseline ps errors and provide platform-aware admission guidance * fix(reverse): rely on typed baseline admission failures and use owning repair formatter in tests * test(reverse): use owning formatters for process ownership remediation assertions * fix(reverse): restrict Linux ownership prerequisite remediation to missing ps and preserve system error codes * fix(reverse): retain typed process ownership prerequisite with preserved error codes * fix(reverse): remove unvalidated error label fallbacks and keep admission tags out of system_code * fix(reverse): keep Windows native runner failures out of command-launch state * fix(process): preserve current_process_unreported refusal in Linux provider readiness * fix(process): distinguish no-code ps failure from missing ps and cover rizin launch failure * fix(windows): classify process_spawn host-control rejections as RuntimeControlUnavailableError |
||
|
|
068c319e82 |
fix(desktop): keep a failed library owner query unknown (#9240)
* fix(desktop): keep a failed library owner query unknown dpkg-query -S exits 1 when some requested path has no owner and 2 when it could not answer at all. LibraryPackageInventory.packageOwners only rejected the missing and failed outcomes, so an exit of 2 with empty stdout parsed as a successful empty owner map and every located library was recorded in unpackaged_libraries. That turns a failed lookup into an incorrect ownership fact and drops the reason, while the executable owner lookup in DebianPackageInventory already treats exit codes above 1 as unknown. Treat an exit code above 1 as a failed query for the batch, report it in library_packages_reason, and leave the libraries it covered out of unpackaged_libraries. Already established missing_libraries are kept. * fix(desktop): retain completed library ownership queries * fix(desktop): report ownership gaps per library --------- Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morluto
|
5d5fe72218 | fix(plist): reserve Evidence framing in nesting allowance | ||
|
|
4d7c6efe9a |
feat(desktop): open the seed's document at launch, and say when a seed was made for the task (#9054)
* feat(desktop): capture, draft, export and witness a task inside a build computer - start_build_capture runs REA's capture inside the computer through a small controller over computer-exec, after a user-space apt-get update; mark_build_checkpoint returns once the capture confirms the checkpoint; stop_build_capture returns the draft between seed and end. - export_build_environment exports with the requester's task inside the computer and fetches the bundle through data/get in bounded batches. - check_build_task grades a computer's data/get with REA's evaluator and, through seed, after_edit, near_miss and after_reset stages, records a witness with the action log and the screen recording; act_on_build_computer gains reset. - Capture progress lines carry window, checkpoint and refusal events; apps start in the home; a pack script builds the runtime archive; long tools send progress notifications. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): make build capture and witness steps retryable, and close the near-miss reset hole - A capture whose start answer is lost is stopped at once and kept unreleased until the stop is confirmed; a lost checkpoint answer is recovered from the capture's own log, and draft and export use the checkpoints its Evidence records; stop can be repeated to resume reading its result. - A witness can check its seed again after a failed read, and keeps its stages in a saving state until the record is written, so a failed save can be retried without reading the app again. - after_edit and near_miss count only click, drag, scroll, type and key, so a reset no longer stands in for the near-miss edit. - A .deb build keeps its package file for capture and passes its URL to export; bundle downloads write each checked file before fetching the next; an apt-get update failure reports its exit code and log tail; reset sends progress while it waits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep the Trash out of seeds, bundle folders unwritten and first frames drawn From the blind Inkscape rebuild: - Paths in ~/.local/share/Trash get a desktop_trash reason and the shared_desktop role, so a file trashed before seed is neither owned nor seeded; the export names it in a limitation. - The keep helper runs with PYTHONDONTWRITEBYTECODE=1, so starting a computer from a bundle folder no longer writes __pycache__ into it. - start_build_computer waits, bounded, until the first frame is not one colour before returning it. From review: a .deb that apt also offers exports from apt, since export passes --package-url only when the capture says the package must come from its file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound the first-frame wait's retries to the time left, with progress throughout Each retry of the drawn-first-frame wait runs under an abort that fires at the 10 s deadline, and the latest frame is returned when time runs out. connect takes the first frame itself while its progress heartbeat still runs, reporting "waiting for the desktop to draw". The wait moves to DrawnScreenshot.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): serialize each build computer's calls, keep one recording id, and separate unreadable checks from failures - One queue per computer: actions, capture steps and witness checks run one at a time, so two overlapping after_edit checks can no longer both be filed and let the witness hold without a near miss. Close cancels the running and queued calls; different computers still run concurrently. - The witness keeps one recording request id per computer, so a seed retried after a lost reply recovers the recording it started. - A check that could not read its file is undecided, not a failure, so a temporary read error can't satisfy seed, near_miss or after_reset; such a stage is refused and can be checked again. - The export's file listing is written to a file and read back in bounded batches, so a large bundle no longer overruns exec's 1 MiB output. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): treat failures on cut views as undecided, require a decided seed failure at export, and keep a close's cancellation - A presence check that misses its line, row or pointed value in a view cut short is undecided rather than failed, since the data may sit in the part left out; a witness stage can no longer be proved by such a failure. - Export counts only decided failures on the seed, and refuses a task whose every seed failure is undecided. - A step whose turn was aborted by a close or the caller returns cancelled even when its work finished, so start_build_capture no longer reports success for a computer being removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a step's saved result when a cancellation arrives during its commit Reporting cancelled for any step whose turn was aborted after its work replaced a completed export or witness save with a bare cancellation, losing what was saved and leaving the witness unreadable. Steps now return what they completed; only start_build_capture, which commits nothing, checks its turn after the post-launch screenshot and reports cancelled. Asking again for a saved witness's final check returns its record. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse a saved witness's repeated check for another folder Asking again for the check that ended a witness returned its saved record whatever directory came with it, so a caller naming another folder got success though nothing was saved there. A different folder is now refused, as an unfinished seed's retry already is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): assert the facts of cut-view and undecided outcomes, not their sentences The new cut-view, missing-value, undecided-refusal and witness tests froze whole descriptions, so a harmless rewording broke them. They now check each outcome's id, passed and undecided exactly and the facts its message must carry (file, pointer, line, row, stage) separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text - Both readers accept a DOCTYPE with only a name and an optional PUBLIC or SYSTEM identifier, record it as the view's doctype, and never fetch the DTD or expand entities beyond XML's five; an internal subset, an external entity and a parameter entity stay refused alike. - text_equals and text_contains compare the concatenated text of the element (or text node or attribute) a pointer reaches, as XPath string() does, with optional normalize_whitespace; both evaluators agree, and a text check on a truncated element is undecided. - Whitespace-only text between elements is dropped only when the element holds no other text, so text split into runs keeps its spaces. - The draft suggests text_equals for an element whose text changed. So an AbiWord .abw reads as XML, and its paragraph's text is checked whole however AbiWord splits it into <c> runs, as Writer's spans are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps - A changed value is read at both ends, so text that became a run still marks its paragraph, and the drafted text_equals moves up out of mixed content to the nearest ancestor named by an attribute, such as AbiWord's p by its xid. - Text checks accept only a text node or an attribute value; element names and doctype fields fail, in both evaluators. - isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy). - XML files are drafted with the keyed diff the archive entries use, so no suggestion reaches an element by position; the shared logic moves to appTaskDraftNamed.ts. - Text-check tests assert facts, not whole sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs' A drafted whole-text check on a paragraph hid every change inside it, so a link whose label and href both changed drafted only the paragraph's text and the new destination went unchecked. The text check now covers text and runs added or removed whole; a changed name or attribute of an element both versions hold keeps its own check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check The owner of `.../attributes/name` was taken as `.../attributes`, so a changed `name` attribute inside a paragraph with a text check was dropped again. The owner is now read by segment, attributes first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container Text typed into a run the diff lists whole was never read, so the draft kept only a presence check on the run, which wrong text also passed. Such text now marks the nearest element both ends hold, or, when none can take the check, the added element's own text. The climb also names an element by an identifier of its own (id, xml:id, xid) before a larger container, so a headline under a long layer keeps a whole-text check that survives re-split runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): expect the whole-text check where #8988's pairing test meets text checks On this branch a changed element's text is drafted as `text_equals` on the element, so the identity pairing test now expects that check, under the same `[@role=body]` key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(skills): build a computer-app environment from a request The product skill gains references/desktop-build.md, a procedure that takes Claude from a request such as "an Inkscape environment where the agent changes a poster's headline" to a witnessed bundle and a report, through start_build_computer, act_on_build_computer, the build capture tools, export_build_environment and check_build_task: questions asked once upfront, pauses only when blocked, a seed made in the app, content checks by selector, a witness with a near miss and a reset in a fresh computer, and solver runs only within a budget. setup installs the new reference; skillVersion 61. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): fold the blind Inkscape rebuild's friction into the build skill key takes an array of one chord's keys; check for a text cursor before typing in apps with single-key shortcuts; in Save As, click Documents and type only the file name; anything saved before seed, the Trash included, is part of the seed; dismiss first-run dialogs before seed; a bundle's app starts with the seed's files but need not open the document; Inkscape's window class is Inkscape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): fold the held-out AbiWord build's friction into the build skill Name the act fields and link the guide; a region screenshot becomes the latest frame; a drawn caret is not focus; confirm dialogs with Return; check the dialog's folder when the app shows only a name; an XML file the draft shows as lines was read as text, so use short line checks; and keep text checks to the value the edit types, since some apps save a reloaded document differently. Later witness stages take no directory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): state the export's seed rule, the Trash exception and draft refusals exactly The export refuses a task unless at least one check fails on the seed and every check passes at the end; a file moved to the Trash is left out of the seed, so trash a stray file rather than starting over; a null draft names its cause in draft_refusal; and a line check on a format read as text only approximates a value, so bound it and call it approximate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): teach the build skill to use DOCTYPE and whole-text checks The skill now checks text an app splits into runs whole with text_equals or text_contains, finds an AbiWord paragraph by its xid, and drops the Writer revision-id workaround. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): point text checks at the paragraph, and say what the scrub replaces From the AbiWord rebuild: point a text check at the paragraph or another element the edit keeps, never at a run a reopened document splits; how to name an unchanged element; the export replaces the host name, user@host and home path while a bare user name stays; AbiWord's entry and class. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep every text check on a cut element undecided, in both evaluators The XML reader drops text deeper than its depth limit but keeps later siblings, and an element's whole text joins both sides, so a text_contains on a cut element could match text the file never holds ("at 3" + deep "WRONG" + ":30 PM" read as "at 3:30 PM"). Any text check on an element of a cut view is now undecided again, as #9050 had it, in REA's evaluator and the exported verifier; a text node or attribute value stays decided. The text check tests assert facts rather than sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): open the seed's document at launch, and say when a seed was made for the task An exported app now opens the seed's one document at launch when its desktop entry's Exec takes files, so a solving agent starts in the document rather than on the app's start screen; a command that already names a file is kept, and several documents or an Exec without a file code keep the launch and say why. `--synthetic-seed`, which the build export passes, words the README and limitations for a seed made in the build computer instead of asking to keep the user's data local. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): count only a document the launch names, absolute or from its working directory, as already opened A settings path under the home, such as geany's --config, kept the seed's document from opening, and a relative document argument was missed and appended again. An argument now counts only when it resolves, from the captured working directory, to a file the capture gave the document role. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): check the seed and launch wording against their formatters, and the facts on their own The tests froze the README's and limitations' sentences, so a harmless rewrite broke them. The wording now comes from exported formatters (`seedWording`, `seedLimitation`, `launchDocumentNote`, `NO_LAUNCH_DOCUMENT`), the tests compare against those, and check the facts separately: which document opens, the respelled path in the command, the README naming it, `--synthetic-seed` and the Evidence's `synthetic_seed`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * refactor(desktop): plan the export's seeds and launch in their own module The merged export module passed the file and function size limits; the seed digests and the launch command now come from `DesktopExportLaunch.ts`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a reset applied when the screenshot asked after it fails Once data/reset and the ready wait succeed, act_on_build_computer's reset is applied in the action log and returns success; a screenshot asked of it that is then refused or throws is named in the result's screenshot_error, with no frame, so the next after_reset stage is not refused. Cancellation still propagates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings A review found two gaps. - A paragraph's whole-text check covered every element added or removed inside it, including ones holding no text: an image frame, a line break. A solver who typed the text but never inserted the image passed. Such an element now keeps its own presence or absence check. - The Python reader kept a DOCTYPE system literal's CRLF where TypeScript normalizes it to LF. Both now report LF. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): wait out long build commands, fail a reset that restores nothing, and tie the witness to its bundle A review found five gaps. - Commands in the computer answer only when they end, but fetch stops waiting for headers after 300 s. So a slow export, draft or start always failed. A command with its own deadline now waits on node:http, bounded by that deadline. - after_reset held whenever some check failed, so a reset that changed nothing passed on the near-miss state. Each check must now come out as it did at the seed. - A failed or partial apt-get update left lists that looked complete, so a second start skipped the update. The update is now recorded only when it succeeds, and rerun otherwise. - A witness on a bundle computer graded whatever task it was given. Its seed stage now refuses a task whose steps or checks differ from the bundle's. - A task too large for one command argument (96 KiB) is refused before the export runs, instead of failing with E2BIG in the computer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): advertise a checkpoint-name pattern that compiles in every JS regex mode main's advertised-pattern test compiles every input schema pattern in v mode, which refuses an unescaped hyphen in a character class. The checkpoint name's hyphen is now escaped, and it means the same in u mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): import textSyntaxFormat once in the state format tests main's mixed-case JSON suffix fix and this branch both added the import, and the merge kept both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a completed reset, an unread seed, and a failed apt update A cancel after data/reset no longer drops the restore from the action log, so a near miss cannot treat the restored seed as an edit. An unreadable seed check that later passes leaves after_reset undecided instead of failing the witness. apt-get update is kept only when Error-Mode reports success and a package list was fetched. The controller reply schema lives with the controller, and capture progress lines are read by their domain parser. * fix(desktop): keep a whitespace-only run under the paragraph text check A run whose only text is whitespace is still text the paragraph check reads. It no longer gets its own presence check, which a later save of the same words without that run would fail. Images and breaks, whose text is empty, still keep their own checks. * fix(desktop): keep an unread reset and a cut text check undecided after_reset stays undecided when any check was not read, even if another check still fails and the unread result's boolean matches the seed. A text check for a child past a truncated view is undecided in both evaluators. A reset whose reply is lost blocks a near miss until a later input or a reset whose reply arrives. * fix(desktop): retry a witness recording and a published record's cleanup A recording that fails to end or download is not written into the witness folder, and a manifest already received is fetched again without ending the recording twice. A folder that is published while its handles fail to close keeps that record and retries the same cleanup instead of writing the folder again. * fix(desktop): keep a published witness error and tag an app data refusal A second failure to close a published witness returns the original error, so its record and cleanup lease stay bound. A reset the app itself refuses is an AppDataRefusal; only a reply that is not that refusal stays unsettled. A missing child of a cut view is undecided with the same description in both evaluators, and the shared cases cover it. * fix(desktop): align a cut view's missing text with the Python check A missing child of a truncated view is undecided for the same sentence in both evaluators, including the pointer the view does not contain. * fix(desktop): keep one published witness cleanup across retries A published record and its bound cleanup error stay together. A later close failure returns that error, and the unused path that built a fresh adapter error is gone. * fix(desktop): keep a bundle task read inside the witness result A cancelled, refused, or failed read of the bundle's task files returns the witness's Result, including a cleanup lease when a handle would not close. * fix(desktop): check build runtime export capability * fix(desktop): provide complete runtime repack command * fix(desktop): retain runtime probe failures * fix(desktop): recognize captured file URL documents * fix(desktop): render captured file URLs at launch * fix(desktop): isolate launcher URL encoding * test(desktop): move launch execution to boundary suite * style: fix desktop launch test formatting * style: format native command path schema --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
Ryan S
|
9d0e87f331 |
feat(browser): reuse admitted browser-socket transport and allow discovery_timeout_ms (#9203)
* feat(browser): reuse admitted browser-socket transport and allow discovery_timeout_ms * fix(browser): close unhealthy shared sockets and clamp max discovery timer * fix(browser): retry failed shared-socket cleanup while peer leases remain active * test(browser): race observation readiness with awaitAcknowledgement and join before mock restore * fix(browser): isolate shared-socket discovery aborts and coalesce cold connects * fix(browser): observe pending cold-connect cleanup failures and isolate fake CDP sessions * refactor(browser): carry typed connect cleanup owners and gate concurrent session test * test(browser): cover loopback socket reuse-key normalization * test(browser): verify distinct browser socket path IDs stay separate |
||
|
Ryan S
|
94182f331e |
feat(go): recover bounded Go string literals from (ptr, len) headers (#9206)
* feat(go): recover bounded Go string literals from (ptr, len) headers * fix(go): deduplicate header scan spans, bound rejected cache, and reject Cf * fix(go): allow U+200C ZWNJ and U+200D ZWJ in Go string literal recovery * fix(go): index Mach-O load regions, validate MCP schema, and add feature specs * test(go): cover Mach-O region-index cancellation and load-region boundaries |
||
|
morluto
|
5553acfe50 | fix(elf): report incomplete kernel module coverage (#9475) | ||
|
morluto
|
5a25d42f23 |
fix(desktop)!: require contemporaneous SQLite member evidence (#9470)
* fix(desktop)!: require contemporaneous SQLite member evidence * fix(desktop): preserve incomplete baseline membership uncertainty |
||
|
morluto
|
3602b64c45 |
fix(providers): retain cleanup ownership across probes and queued work (#9468)
* fix(providers): retain cleanup ownership across probes and queued work * fix(jeb): retain primary discovery failures during cleanup * test(providers): bound cleanup and readiness barriers * test(jeb): scope availability cleanup fault injection * test(jeb): retain caller error through cleanup recovery |
||
|
morluto
|
9e78606e2b | fix(inspector)!: retain context lifetimes across protocol ID reuse (#9471) | ||
|
morlutoandCursor Agent
|
88cf498036 |
fix!: preserve results when source publication fails (#8444)
* fix: retain address context cleanup failures * fix!: preserve address context input errors BREAKING CHANGE: Strict clients that cached the previous full inspect_address_context output schema must refresh tools/list and accept the typed error field on unavailable facets. * test: use session contract for address context * fix!: preserve address context resource recovery BREAKING CHANGE: Clients validating unavailable context facets against a cached strict full output schema must refresh tools/list to accept resource_constraint errors. * fix: expose authenticated records refused by the evidence ledger (#8426) * fix: preserve completed evidence on retention refusal * fix: preserve context when unretained evidence exceeds delivery limits * fix(mcp): recover oversized context from session evidence * fix(evidence): preserve completed atomic write results * fix: retain completed results when source publication fails * test: cover bounded recovery with unknown retention * fix(evidence): preserve recovery identity and finalization facts * fix(evidence): clarify retention of omitted observations * test(evidence): compare omission guidance with its owner * fix(evidence): preserve completed composed workflows * fix(evidence): clarify unretained recovery export * test(evidence): cover mixed recovery guidance * fix(evidence): preserve caller scope in secondary failures * refactor(evidence): remove superseded cleanup projection * test(evidence): align recovery checks with owners * fix: preserve cleanup on partial recovery limits * test: use owners for diagnostic wording * fix: admit completed analysis before evidence construction * fix: preserve selected paths when reusing evidence * fix(cli): preserve caller path in unretained evidence * fix(evidence): preserve recovery metadata and admission bounds * refactor: consolidate evidence closure imports * style(test): format CLI help default annotations (#9280) * test(mcp): keep recovery checks focused on contract facts * fix(evidence): preserve feature trace replay revision * test: align evidence recovery checks with ownership * test: align partial recovery and cleanup diagnostics * fix(evidence): preserve nested partials during cleanup * fix(evidence): respect outer recovery ownership * fix(capture): discard rejected nested observations * test(frida): assert inline evidence recovery --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
c5ed046d6e |
fix(ghidra)!: qualify memory effect coverage (#8651)
* fix(ghidra): qualify memory effect coverage * fix(native): retain value trace source limitations * fix(native): distinguish value trace policy commitments * fix(ghidra): bind value-flow scope to snapshot profile * test(ghidra): verify legacy value-flow snapshot recovery |
||
|
|
03a3fcbcea |
feat(skills): build a computer-app environment from a request (#9049)
* feat(desktop): capture, draft, export and witness a task inside a build computer - start_build_capture runs REA's capture inside the computer through a small controller over computer-exec, after a user-space apt-get update; mark_build_checkpoint returns once the capture confirms the checkpoint; stop_build_capture returns the draft between seed and end. - export_build_environment exports with the requester's task inside the computer and fetches the bundle through data/get in bounded batches. - check_build_task grades a computer's data/get with REA's evaluator and, through seed, after_edit, near_miss and after_reset stages, records a witness with the action log and the screen recording; act_on_build_computer gains reset. - Capture progress lines carry window, checkpoint and refusal events; apps start in the home; a pack script builds the runtime archive; long tools send progress notifications. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): make build capture and witness steps retryable, and close the near-miss reset hole - A capture whose start answer is lost is stopped at once and kept unreleased until the stop is confirmed; a lost checkpoint answer is recovered from the capture's own log, and draft and export use the checkpoints its Evidence records; stop can be repeated to resume reading its result. - A witness can check its seed again after a failed read, and keeps its stages in a saving state until the record is written, so a failed save can be retried without reading the app again. - after_edit and near_miss count only click, drag, scroll, type and key, so a reset no longer stands in for the near-miss edit. - A .deb build keeps its package file for capture and passes its URL to export; bundle downloads write each checked file before fetching the next; an apt-get update failure reports its exit code and log tail; reset sends progress while it waits. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep the Trash out of seeds, bundle folders unwritten and first frames drawn From the blind Inkscape rebuild: - Paths in ~/.local/share/Trash get a desktop_trash reason and the shared_desktop role, so a file trashed before seed is neither owned nor seeded; the export names it in a limitation. - The keep helper runs with PYTHONDONTWRITEBYTECODE=1, so starting a computer from a bundle folder no longer writes __pycache__ into it. - start_build_computer waits, bounded, until the first frame is not one colour before returning it. From review: a .deb that apt also offers exports from apt, since export passes --package-url only when the capture says the package must come from its file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): bound the first-frame wait's retries to the time left, with progress throughout Each retry of the drawn-first-frame wait runs under an abort that fires at the 10 s deadline, and the latest frame is returned when time runs out. connect takes the first frame itself while its progress heartbeat still runs, reporting "waiting for the desktop to draw". The wait moves to DrawnScreenshot.ts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): serialize each build computer's calls, keep one recording id, and separate unreadable checks from failures - One queue per computer: actions, capture steps and witness checks run one at a time, so two overlapping after_edit checks can no longer both be filed and let the witness hold without a near miss. Close cancels the running and queued calls; different computers still run concurrently. - The witness keeps one recording request id per computer, so a seed retried after a lost reply recovers the recording it started. - A check that could not read its file is undecided, not a failure, so a temporary read error can't satisfy seed, near_miss or after_reset; such a stage is refused and can be checked again. - The export's file listing is written to a file and read back in bounded batches, so a large bundle no longer overruns exec's 1 MiB output. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): treat failures on cut views as undecided, require a decided seed failure at export, and keep a close's cancellation - A presence check that misses its line, row or pointed value in a view cut short is undecided rather than failed, since the data may sit in the part left out; a witness stage can no longer be proved by such a failure. - Export counts only decided failures on the seed, and refuses a task whose every seed failure is undecided. - A step whose turn was aborted by a close or the caller returns cancelled even when its work finished, so start_build_capture no longer reports success for a computer being removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a step's saved result when a cancellation arrives during its commit Reporting cancelled for any step whose turn was aborted after its work replaced a completed export or witness save with a bare cancellation, losing what was saved and leaving the witness unreadable. Steps now return what they completed; only start_build_capture, which commits nothing, checks its turn after the post-launch screenshot and reports cancelled. Asking again for a saved witness's final check returns its record. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): refuse a saved witness's repeated check for another folder Asking again for the check that ended a witness returned its saved record whatever directory came with it, so a caller naming another folder got success though nothing was saved there. A different folder is now refused, as an unfinished seed's retry already is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): assert the facts of cut-view and undecided outcomes, not their sentences The new cut-view, missing-value, undecided-refusal and witness tests froze whole descriptions, so a harmless rewording broke them. They now check each outcome's id, passed and undecided exactly and the facts its message must carry (file, pointer, line, row, stage) separately. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text - Both readers accept a DOCTYPE with only a name and an optional PUBLIC or SYSTEM identifier, record it as the view's doctype, and never fetch the DTD or expand entities beyond XML's five; an internal subset, an external entity and a parameter entity stay refused alike. - text_equals and text_contains compare the concatenated text of the element (or text node or attribute) a pointer reaches, as XPath string() does, with optional normalize_whitespace; both evaluators agree, and a text check on a truncated element is undecided. - Whitespace-only text between elements is dropped only when the element holds no other text, so text split into runs keeps its spaces. - The draft suggests text_equals for an element whose text changed. So an AbiWord .abw reads as XML, and its paragraph's text is checked whole however AbiWord splits it into <c> runs, as Writer's spans are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps - A changed value is read at both ends, so text that became a run still marks its paragraph, and the drafted text_equals moves up out of mixed content to the nearest ancestor named by an attribute, such as AbiWord's p by its xid. - Text checks accept only a text node or an attribute value; element names and doctype fields fail, in both evaluators. - isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy). - XML files are drafted with the keyed diff the archive entries use, so no suggestion reaches an element by position; the shared logic moves to appTaskDraftNamed.ts. - Text-check tests assert facts, not whole sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs' A drafted whole-text check on a paragraph hid every change inside it, so a link whose label and href both changed drafted only the paragraph's text and the new destination went unchecked. The text check now covers text and runs added or removed whole; a changed name or attribute of an element both versions hold keeps its own check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check The owner of `.../attributes/name` was taken as `.../attributes`, so a changed `name` attribute inside a paragraph with a text check was dropped again. The owner is now read by segment, attributes first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container Text typed into a run the diff lists whole was never read, so the draft kept only a presence check on the run, which wrong text also passed. Such text now marks the nearest element both ends hold, or, when none can take the check, the added element's own text. The climb also names an element by an identifier of its own (id, xml:id, xid) before a larger container, so a headline under a long layer keeps a whole-text check that survives re-split runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): expect the whole-text check where #8988's pairing test meets text checks On this branch a changed element's text is drafted as `text_equals` on the element, so the identity pairing test now expects that check, under the same `[@role=body]` key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat(skills): build a computer-app environment from a request The product skill gains references/desktop-build.md, a procedure that takes Claude from a request such as "an Inkscape environment where the agent changes a poster's headline" to a witnessed bundle and a report, through start_build_computer, act_on_build_computer, the build capture tools, export_build_environment and check_build_task: questions asked once upfront, pauses only when blocked, a seed made in the app, content checks by selector, a witness with a near miss and a reset in a fresh computer, and solver runs only within a budget. setup installs the new reference; skillVersion 61. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): fold the blind Inkscape rebuild's friction into the build skill key takes an array of one chord's keys; check for a text cursor before typing in apps with single-key shortcuts; in Save As, click Documents and type only the file name; anything saved before seed, the Trash included, is part of the seed; dismiss first-run dialogs before seed; a bundle's app starts with the seed's files but need not open the document; Inkscape's window class is Inkscape. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): fold the held-out AbiWord build's friction into the build skill Name the act fields and link the guide; a region screenshot becomes the latest frame; a drawn caret is not focus; confirm dialogs with Return; check the dialog's folder when the app shows only a name; an XML file the draft shows as lines was read as text, so use short line checks; and keep text checks to the value the edit types, since some apps save a reloaded document differently. Later witness stages take no directory. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): state the export's seed rule, the Trash exception and draft refusals exactly The export refuses a task unless at least one check fails on the seed and every check passes at the end; a file moved to the Trash is left out of the seed, so trash a stray file rather than starting over; a null draft names its cause in draft_refusal; and a line check on a format read as text only approximates a value, so bound it and call it approximate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): teach the build skill to use DOCTYPE and whole-text checks The skill now checks text an app splits into runs whole with text_equals or text_contains, finds an AbiWord paragraph by its xid, and drops the Writer revision-id workaround. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(skills): point text checks at the paragraph, and say what the scrub replaces From the AbiWord rebuild: point a text check at the paragraph or another element the edit keeps, never at a run a reopened document splits; how to name an unchanged element; the export replaces the host name, user@host and home path while a bare user name stays; AbiWord's entry and class. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep every text check on a cut element undecided, in both evaluators The XML reader drops text deeper than its depth limit but keeps later siblings, and an element's whole text joins both sides, so a text_contains on a cut element could match text the file never holds ("at 3" + deep "WRONG" + ":30 PM" read as "at 3:30 PM"). Any text check on an element of a cut view is now undecided again, as #9050 had it, in REA's evaluator and the exported verifier; a text node or attribute value stays decided. The text check tests assert facts rather than sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a reset applied when the screenshot asked after it fails Once data/reset and the ready wait succeed, act_on_build_computer's reset is applied in the action log and returns success; a screenshot asked of it that is then refused or throws is named in the result's screenshot_error, with no frame, so the next after_reset stage is not refused. Cancellation still propagates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings A review found two gaps. - A paragraph's whole-text check covered every element added or removed inside it, including ones holding no text: an image frame, a line break. A solver who typed the text but never inserted the image passed. Such an element now keeps its own presence or absence check. - The Python reader kept a DOCTYPE system literal's CRLF where TypeScript normalizes it to LF. Both now report LF. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): wait out long build commands, fail a reset that restores nothing, and tie the witness to its bundle A review found five gaps. - Commands in the computer answer only when they end, but fetch stops waiting for headers after 300 s. So a slow export, draft or start always failed. A command with its own deadline now waits on node:http, bounded by that deadline. - after_reset held whenever some check failed, so a reset that changed nothing passed on the near-miss state. Each check must now come out as it did at the seed. - A failed or partial apt-get update left lists that looked complete, so a second start skipped the update. The update is now recorded only when it succeeds, and rerun otherwise. - A witness on a bundle computer graded whatever task it was given. Its seed stage now refuses a task whose steps or checks differ from the bundle's. - A task too large for one command argument (96 KiB) is refused before the export runs, instead of failing with E2BIG in the computer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): advertise a checkpoint-name pattern that compiles in every JS regex mode main's advertised-pattern test compiles every input schema pattern in v mode, which refuses an unescaped hyphen in a character class. The checkpoint name's hyphen is now escaped, and it means the same in u mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): import textSyntaxFormat once in the state format tests main's mixed-case JSON suffix fix and this branch both added the import, and the merge kept both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep a completed reset, an unread seed, and a failed apt update A cancel after data/reset no longer drops the restore from the action log, so a near miss cannot treat the restored seed as an edit. An unreadable seed check that later passes leaves after_reset undecided instead of failing the witness. apt-get update is kept only when Error-Mode reports success and a package list was fetched. The controller reply schema lives with the controller, and capture progress lines are read by their domain parser. * fix(desktop): keep a whitespace-only run under the paragraph text check A run whose only text is whitespace is still text the paragraph check reads. It no longer gets its own presence check, which a later save of the same words without that run would fail. Images and breaks, whose text is empty, still keep their own checks. * fix(desktop): keep an unread reset and a cut text check undecided after_reset stays undecided when any check was not read, even if another check still fails and the unread result's boolean matches the seed. A text check for a child past a truncated view is undecided in both evaluators. A reset whose reply is lost blocks a near miss until a later input or a reset whose reply arrives. * fix(desktop): retry a witness recording and a published record's cleanup A recording that fails to end or download is not written into the witness folder, and a manifest already received is fetched again without ending the recording twice. A folder that is published while its handles fail to close keeps that record and retries the same cleanup instead of writing the folder again. * fix(desktop): keep a published witness error and tag an app data refusal A second failure to close a published witness returns the original error, so its record and cleanup lease stay bound. A reset the app itself refuses is an AppDataRefusal; only a reply that is not that refusal stays unsettled. A missing child of a cut view is undecided with the same description in both evaluators, and the shared cases cover it. * fix(desktop): align a cut view's missing text with the Python check A missing child of a truncated view is undecided for the same sentence in both evaluators, including the pointer the view does not contain. * fix(desktop): keep one published witness cleanup across retries A published record and its bound cleanup error stay together. A later close failure returns that error, and the unused path that built a fresh adapter error is gone. --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: morluto <morluto@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morlutoandCursor Agent
|
b81da90354 |
feat(native): page retained procedure references (#8588)
* feat(native): page retained feature traces * fix(snapshot): retain linked source evidence for replay * test(snapshot): verify linked foreign evidence stays scoped * feat(native): page retained procedure references * docs(mcp): clarify imported residual questions * docs(mcp): guide trace reference classification * fix(cli): report result sources when Evidence publication fails A trace keeps linked sources on the result. Use those records for the undelivered source closure as well as the bundle, so a refused output does not report them as not captured. * ci: rerun pull request checks The merge of origin/main did not start the CI workflow for this head. * fix(native): document shared procedure endpoints and the required selector Describe kind shared and items.endpoints instead of inline procedure copies. State that procedure-references requires a positional selector or --procedure. * fix(native): count procedure-reference endpoints before keeping a row Include the shared endpoint table in the page budget, with JSON punctuation, and store a new procedure only when its row is accepted. * fix(native): measure a procedure endpoint once before its comparison key Size the candidate before building one canonical identity, and reuse that key for the selected-procedure and shared-endpoint checks. * fix(native): reject an oversized procedure endpoint before canonicalizing it When the JSON size already exceeds every stored identity, skip the canonical string and keep the row out of the page. * fix(native): describe procedure-reference direction and coverage Avoid execution wording in the tool description, and give the CLI direction option the help text the catalog requires. * fix(native): compare endpoint size with UTF-8 identity length Keep one running maximum of stored identity bytes. A multibyte selected procedure is recognized when its JSON no longer fits the page. * test(cli): count procedure-references as a dedicated command The MCP tool has a CLI command, so it is no longer an MCP-only exception. * test(native): catch the string-length endpoint comparison Use a 200,000-character multibyte selected procedure and a shorter ASCII endpoint so the old JavaScript length check drops the selected row. * ci: rerun after the binary-layout toolchain timeout The required check failed because the toolchain install exceeded 15 minutes. The same job completed on the previous head, and this commit does not change the procedure-reference behavior. * test: stabilize capture decoder exhaustion coverage --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
887b99888e |
fix(ghidra)!: distinguish skipped overlays in byte search (#8608)
* fix(ghidra)!: distinguish skipped overlays in byte search BREAKING CHANGE: Byte search results require skipped_overlays; loaded overlays no longer appear in skipped_not_loaded. The Ghidra profile changes so prior snapshots are not replayed. * fix(cli): explain overlay byte search scope * test(ghidra): exercise overlay search cursor handoff * test(ghidra): avoid freezing byte search help wording * test(ghidra): classify search start as an address bound * docs(ghidra): match the raw lane's overlay coverage The raw Ghidra lane checks a manually created overlay block through MCP. Say that, and do not claim an overlapping-load ELF, CLI search, or snapshot cursor handoff. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
0b028cc75a |
feat(mcp): refresh provider candidates without switching (#8487)
* fix(mcp): report provider candidate observation scope * feat(mcp): refresh provider candidates without switching * docs: clarify candidate inspection ownership * fix(mcp): clarify provider reselection on reopen * test(mcp): bound candidate refresh lifecycle gates * test(mcp): keep temporary fixture cleanup with its owner |
||
|
morluto
|
1a0e2c77f2 |
fix(ghidra): qualify selected project call coverage (#8391)
* fix(ghidra): qualify selected project call coverage * test(ghidra): retain verifier MCP cleanup ownership * test(ghidra): document trusted verifier compiler selection * test(ghidra): document owned verifier exit marker * test(ghidra): remove ineffective scan directives * fix(ghidra): supervise project coverage verification * fix(ghidra): supervise verifier compiler process |
||
|
morluto
|
015a02d57b |
feat(ghidra)!: identify containing code and data (#8777)
* feat(ghidra)!: identify containing listed instructions * fix(ghidra): validate instruction containment status * fix(ghidra): validate containment coordinates * feat(ghidra): identify containing defined data * test(ghidra): correct snapshot and containment controls * docs(native): distinguish object and dynamic type sizes * docs(cli): retain incoming reference guidance * fix(mcp): clarify data object address guidance * test(ghidra): preserve defined data in reference fixtures |
||
|
morluto
|
688dca3e90 |
fix(mcp): report native value flow support in session status (#8786)
* fix(native)!: preserve value-flow absence semantics * fix(mcp): report native value flow support in session status * test(mcp): share schema validation and assert status facts * chore: preserve unrelated main imports |
||
|
morlutoandCursor Agent
|
197a296664 |
fix(session): guide unsupported provider recovery (#8567)
* fix(session): guide unsupported provider recovery * fix(session): clarify provider switch state loss * fix(session): distinguish evidence from provider edits * fix(session): preserve workflow-specific recovery * test(session): compare recovery with its owner * fix(session): guide available entry-comment handoff * fix(session): condition provider handoff on readiness * fix(cli): clarify target-free provider discovery * test(mcp): remove duplicated recovery wording checks * test(mcp): keep provider-selection binding case within the line limit The merged unknown-provider checks stay in the same scenario and pass the workspace path explicitly. * test(mcp): use one temporary directory owner * test: avoid freezing retry remediation wording --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
aa2c1c61ce |
feat(mcp): report provider release verification in session (#8485)
* feat(mcp): report provider release verification in session * test(kuna): verify release guidance at its owner * fix(kuna): verify release against reported version * test(mcp): keep temporary fixture cleanup with its owner |
||
|
morlutoandCursor Agent
|
2d25a09c0f |
fix(native)!: recognize identical function evidence (#8442)
* fix(native)!: recognize identical function evidence * test(native): verify same-evidence dimension citations * fix(compare): reject impossible same-evidence changes A comparison of one Evidence record cannot report a changed dimension, unequal subject hashes, or unequal digests on an unchanged dimension. * test(compare): admit the partial same-evidence fixture explicitly --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
9109e6f6a7 |
fix(ghidra): guide ambiguous selector recovery (#8768)
* fix(ghidra): guide ambiguous procedure selection * test(ghidra): distinguish malformed selectors * fix(ghidra): distinguish ambiguous file mappings * fix(ghidra): name mapping inspection workflows * docs(mcp): expose strict Ghidra address selection * docs(cli): explain Ghidra qualified address selection * test(ghidra): cover published ambiguous selector codes MCP and projection tests use procedure_ambiguous and file_offset_ambiguous, and match the recovery main already publishes for those codes. * fix(ghidra): name the space-qualified address that avoids offset fallback file_offset_ambiguous now tells the caller to use a form such as ram:0x1000. A bare 0x selector repeats the file-offset lookup. The MCP test requires that route and inspect_native_load_image. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
ce45f92219 |
docs(mcp): clarify retained evidence view support (#8480)
* docs(mcp): clarify retained evidence view support * docs(mcp): describe pageable pseudocode alternative * docs(mcp): page retained procedure pseudocode in place procedure_pseudo_code Evidence already supports summary and native pseudocode views of the original observation. The guide no longer says that paging requires a new analyze_function dossier. --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
1071ad867c |
fix(test): report caller target selection coverage (#8406)
* fix(test): report caller target selection coverage * test(kuna): cover passing caller target selection --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
c06b53644b |
fix(ghidra)!: preserve facts in inventory searches (#8376)
* fix(ghidra)!: preserve facts in inventory searches BREAKING CHANGE: Ghidra snapshots made before the search projection profile revision no longer match. Run fresh analysis and save a new snapshot. * test(ghidra): update raw profile digest goldens |
||
|
|
a67525cdf1 |
docs: organize canonical documentation layout and verify new pages (#2791)
* docs: organize canonical documentation layout (URGENTE) Group all existing authored guides by domain and ownership, expose complete navigation, and preserve their public routes. Update physical path consumers and release configuration while retaining historical records. Document domain-based specs and ADR slugs without global numbering. Co-Authored-By: Codex <noreply@openai.com> * fix(docs): honor home layout in all-page route verification * style: format reviewed source changes * fix(docs): preserve routes and navigation cache inputs * fix: repair the static-check failures on the default branch (#2895) * fix: repair the static-check failures on the default branch The default branch fails its own required `Static checks` job three ways, so every pull request reports that job as failed regardless of its own change. - `npm run format:check` reports `src/domain/functionComparison.test.ts` and `src/ida/IdaOperationRunner.ts`. - `npm run lint` reports a duplicate `import { join } from "node:path"` in `tests/boundary/mcp/ghidraInventoryMcp.test.ts` (lines 4 and 17). - `npm run typecheck` reports `format: "devin"` missing from the client format union in `src/application/SupportedClients.ts`, and an unchecked index in `tests/boundary/cli/clientProfileLifecycle.test.ts`, whose pair array is inferred as `string[][]`. Apply the pinned formatter, drop the duplicate import, list the `"devin"` format that its own definition already uses, and mark the pair array `as const`. Validation: `npm run check:fast` and `npm run format:check` pass. * fix(setup): keep Devin on the JSON configuration dialect --------- Co-authored-by: 吴佳浩 <wujiahao@supremind.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> * fix(docs): update links after guide relocation * docs: correct verified documentation route counts * fix(docs): update browser capture guide link after move (#2820) Refresh gettext protected-link comments alongside the authored href. Co-authored-by: Codex <noreply@openai.com> * fix(docs): include http3 lab in stable routes * fix(docs): preserve historical release evidence and links * fix(ghidra): restore Windows verifier identity import * docs(wakaru): preserve pinned upstream policy link * docs(index): retain recently added guide links * docs(mcp): preserve parent retention clarification * fix(cli): preserve standalone import guidance * fix(test): preserve translated guide link drift coverage --------- Co-authored-by: Matheus Breguêz <matbrgz@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: morluto <17176810+morluto@users.noreply.github.com> Co-authored-by: 吴佳浩Alben <35291372+XiaoBinGan@users.noreply.github.com> Co-authored-by: 吴佳浩 <wujiahao@supremind.com> |
||
|
morlutoandCursor Agent
|
d5b5808f91 |
fix(mcp): qualify retained Evidence view guidance (#8377)
* fix(mcp): qualify retained Evidence view guidance * style(test): format CLI help default annotations (#9280) --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
cbd4bd4a66 |
fix(ghidra): explain literal search candidate evidence (#8816)
* fix(ghidra): explain literal search candidate evidence
* style(test): format CLI help default annotations (#9280)
(cherry picked from commit
|
||
|
morlutoandCursor Agent
|
31278c7b5a |
fix!: qualify call paths by provider discovery (#8443)
* fix!: qualify call paths by provider discovery * fix: preserve compact call coverage schema guidance * fix: preserve call discovery reasons in path evidence * fix(evidence): retain discovery limits in call verification * test: declare discovery in reconstruction controls * fix: preserve call discovery across facet limits --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
18cc16141c |
docs(mcp): clarify residual unknown target scope (#8547)
* docs(mcp): clarify residual unknown target scope * docs(mcp): explain unknown update subject --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
60f9a4c69a |
fix(native): show function match limitations by default (#8558)
Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
4bb53000a3 |
fix(ghidra): clarify function annotation selectors (#8584)
* fix(ghidra): clarify function annotation selectors * test(ghidra): compare catalog guidance with its contract --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
e47bb152c2 |
feat(native): retry failed directory decompiles independently (#8811)
* feat(kuna): allow independent decompile retries
* fix(kuna): correct independent retry recovery
* feat(native): retain decompile export source facts
* test(native): verify historical export source facts
* test(kuna): bound retry lifecycle acknowledgement
* test(native): retain source after export conflict
* feat(kuna): allow independent decompile retries
* fix(kuna): correct independent retry recovery
* test(kuna): bound retry lifecycle acknowledgement
* feat(native): retry failed directory decompiles independently
* fix(native): guide directory retry after provider failure
* fix(native): point retry caveats to the journal
* style(test): format CLI help default annotations (#9280)
(cherry picked from commit
|
||
|
morlutoandCursor Agent
|
81c09888bf |
feat(kuna): allow independent decompile retries (#8793)
* feat(kuna): allow independent decompile retries
* fix(kuna): correct independent retry recovery
* test(kuna): bound retry lifecycle acknowledgement
* style(test): format CLI help default annotations (#9280)
(cherry picked from commit
|
||
|
morlutoandCursor Agent
|
106ba1730f |
fix!: preserve address context resource recovery (#8424)
* fix: retain address context cleanup failures * fix!: preserve address context input errors BREAKING CHANGE: Strict clients that cached the previous full inspect_address_context output schema must refresh tools/list and accept the typed error field on unavailable facets. * test: use session contract for address context * fix!: preserve address context resource recovery BREAKING CHANGE: Clients validating unavailable context facets against a cached strict full output schema must refresh tools/list to accept resource_constraint errors. * fix: expose authenticated records refused by the evidence ledger (#8426) * fix: preserve completed evidence on retention refusal * fix: preserve context when unretained evidence exceeds delivery limits * fix(mcp): recover oversized context from session evidence * fix(evidence): preserve completed atomic write results * fix(cli): preserve caller path in unretained evidence * style(test): format CLI help default annotations (#9280) --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morlutoandCursor Agent
|
f7dc5489b3 |
feat(kuna): preserve stored pointer references (#8851)
* feat(kuna): verify release 1.990 * feat(kuna): preserve stored pointer references * fix(kuna): group image-wide reference coverage gaps * fix(evidence): retain producer-required xref observations * fix(mcp): clarify xref address page scope * fix(kuna): preserve reference target aliases --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
|
3e8a5f76d0 |
feat(native): retain LLDB source coordinates and verify Pascal calls (#2800)
* feat(native): retain LLDB source coordinates and verify Pascal call entries Preserve partial line-table attribution for native locations and historical evidence compatibility. Verify owned Free Pascal call entries through CLI/MCP. Refs #2382, #2372, #2397 Co-Authored-By: Codex <noreply@openai.com> * docs: namespace native specifications by domain and feature Use stable descriptive paths instead of numeric prefixes to avoid parallel contribution collisions. Co-Authored-By: Codex <noreply@openai.com> * fix(native): bound Pascal verification and compare caller coordinates Address review findings at their producing boundaries and preserve directly affected consumers. Source inspection and git diff --check completed. Tests and automated checks were not run at the user’s explicit request. * fix(native): bound compiler shutdown and source-coordinate fixtures * docs: clarify historical native source verification * fix(native): preserve source attribution and compiler ownership * docs(native): qualify retained source attribution * fix(ci): clean up native Pascal verifier processes * test(native): type the Pascal verifier helper import after merging main Main now typechecks this boundary test, which imports the untyped canonical-temporary-directory helper and reads an unknown catch value. Add the helper's declaration file and narrow the caught error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(native): verify partial source attribution caveat * fix(native): retain verifier compiler cleanup ownership * fix(native): forward verifier cancellation and measure path bytes CLI and MCP artifact runs observe the verifier abort signal, and a failed Pascal verifier test stops the compiler group before deleting its directory. Repeated source locations grow by measured UTF-8 JSON bytes; workflow tokens, CPU and peak memory stay unmeasured. --------- Co-authored-by: Matheus Breguêz <matbrgz@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
Nianze Wuandmorluto
|
5d21bddb18 |
fix(desktop): read JSON with deeply nested overwritten values (#9277)
* fix(desktop): read JSON with deeply nested overwritten values * fix(desktop): bound exported JSON construction by view depth * fix(desktop): preserve deep JSON numeric facts within bounded memory --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morlutoandCursor Agent
|
0ecf3a4cbf |
docs(mcp): document native function analysis scope (#8389)
Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
Edgar Arakelyan
|
c5301e6145 | feat(desktop): capture, draft, export and witness a task inside a build computer (#9045) | ||
|
gensokyo-dev
|
8eff651270 |
fix(ghidra): make checkpoint workflows discoverable (#9246)
Expose the existing opt-in Ghidra checkpoint lifecycle in tool descriptions and summary capabilities. Distinguish confirmed initial analysis from restored Programs, preserving the checkpoint path and digest through shared CLI/MCP results. Remove prose-driven checks and their scaffolding; retain canonical effects and lifecycle/source-fact coverage. Validated with 445 focused tests, 13 real Ghidra CLI/MCP scenarios and three isolated local Codex CLI tasks covering disabled setup, saving edits and fresh-agent restoration. |
||
|
Shivam Dwivedi
|
36dcd985e1 |
docs(clients): document llama.cpp MCP setup (#4878)
* docs(clients): document llama.cpp MCP setup * docs(clients): clarify persistent installs and llama.cpp deadlines * docs(clients): escape Windows paths in llama.cpp config |
||
|
gensokyo-dev
|
c07ab4b994 |
feat(ghidra): checkpoint owned Programs across sessions
Add opt-in REA_GHIDRA_CHECKPOINT_DIR for owned Ghidra Program persistence through the shared CLI/MCP provider. Save completed initial analysis and metadata changes on normal close; verify and restore the last successful packed Program without auto-analysis. Preserve generation identity, exclusive ownership, typed cancellation and cleanup retry. Refresh checkpoint-dependent profiles after retirement, including failed-switch restoration, while retaining caller selection provenance. Keep source executables and caller projects unchanged. Validated with 720 focused tests (3 platform skips), 13 real Ghidra CLI/MCP scenarios, static/docs checks and CI. Review findings addressed. No version bump or release publication. Refs #8165. |
||
|
Edgar ArakelyanandClaude Opus 5.5
|
ac23dc8077 |
feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text (#9050)
* feat(desktop): read XML with a plain DOCTYPE, and check an element's whole text - Both readers accept a DOCTYPE with only a name and an optional PUBLIC or SYSTEM identifier, record it as the view's doctype, and never fetch the DTD or expand entities beyond XML's five; an internal subset, an external entity and a parameter entity stay refused alike. - text_equals and text_contains compare the concatenated text of the element (or text node or attribute) a pointer reaches, as XPath string() does, with optional normalize_whitespace; both evaluators agree, and a text check on a truncated element is undecided. - Whitespace-only text between elements is dropped only when the element holds no other text, so text split into runs keeps its spaces. - The draft suggests text_equals for an element whose text changed. So an AbiWord .abw reads as XML, and its paragraph's text is checked whole however AbiWord splits it into <c> runs, as Writer's spans are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft whole-text checks on the paragraph, read only text as text, and skip asctime stamps - A changed value is read at both ends, so text that became a run still marks its paragraph, and the drafted text_equals moves up out of mixed content to the nearest ancestor named by an attribute, such as AbiWord's p by its xid. - Text checks accept only a text node or an attribute value; element names and doctype fields fail, in both evaluators. - isTimestamp also recognises asctime dates (Www Mmm dd hh:mm:ss yyyy). - XML files are drafted with the keyed diff the archive entries use, so no suggestion reaches an element by position; the shared logic moves to appTaskDraftNamed.ts. - Text-check tests assert facts, not whole sentences. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks on a changed attribute inside a paragraph whose text check replaces its runs' A drafted whole-text check on a paragraph hid every change inside it, so a link whose label and href both changed drafted only the paragraph's text and the new destination went unchecked. The text check now covers text and runs added or removed whole; a changed name or attribute of an element both versions hold keeps its own check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): read an attribute called name or attributes as an attribute when the draft keeps its check The owner of `.../attributes/name` was taken as `.../attributes`, so a changed `name` attribute inside a paragraph with a text check was dropped again. The owner is now read by segment, attributes first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): draft text checks from text in runs added whole, and name a text element by its own id before its container Text typed into a run the diff lists whole was never read, so the draft kept only a presence check on the run, which wrong text also passed. Such text now marks the nearest element both ends hold, or, when none can take the check, the added element's own text. The climb also names an element by an identifier of its own (id, xml:id, xid) before a larger container, so a headline under a long layer keeps a whole-text check that survives re-split runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): expect the whole-text check where #8988's pairing test meets text checks On this branch a changed element's text is drafted as `text_equals` on the element, so the identity pairing test now expects that check, under the same `[@role=body]` key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(desktop): keep checks for elements without text beside a text edit, and normalize DOCTYPE system id line endings A review found two gaps. - A paragraph's whole-text check covered every element added or removed inside it, including ones holding no text: an image frame, a line break. A solver who typed the text but never inserted the image passed. Such an element now keeps its own presence or absence check. - The Python reader kept a DOCTYPE system literal's CRLF where TypeScript normalizes it to LF. Both now report LF. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(desktop): import textSyntaxFormat once in the state format tests main's mixed-case JSON suffix fix and this branch both added the import, and the merge kept both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Saurabh Sungh
|
abfccc0683 |
fix(javascript): bound symbolic property and member queries (#8876)
Fixes #8838. Admit all symbolic query entry points through the existing resolver budget, preserve cache-hit depth and restore entered frames in finally. Retain independent facts with partial source coverage instead of losing entire scripts to recursive spreads. Validated 273 focused tests, check:fast/docs:check, real CLI/stdio-MCP projections and complete parent reads, independent public-source oracle, and unchanged full results for the official Electron control and Bitwarden selected preload. Full technical CI 42308068679 passes, including all eight shards and required aggregates. Greptile reviews this head at 5/5; no completed Codex review of this head is available. The Author readiness-only exception is explicitly authorized; no human-review attestation is added. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) |
||
|
Soukyu
|
48f5f30fd5 |
fix(cli): reject malformed dry-run literals before changes (#7870)
Fixes #7540. Retain every raw dryRun literal at the shared inert token binder before Incur boolean coercion; preserve parser-owned values, original execution, defaults and variadics. Return an actionable typed PARSE_ERROR before setup or environment publication. Validated 40 focused tests, independent nine-call compiled-CLI before/after configuration controls, check:fast and docs:check. Full technical CI 42302162266 passes, including all eight shards and required aggregates. Greptile reviews this head at 5/5; no completed Codex review of this head is available. The Author readiness-only exception is explicitly authorized; no human-review attestation is added. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) |