Bind typed service creation, observed availability and retryable cleanup in one composition owner. Reuse selected CLI/MCP factories and canonical contract groups without copying provider operation inventories.
Closes#8429. Refs #740.
Validated paired real application workflows, actual local Codex CLI Terra/high use, complete Evidence and Unknown checkpoint parity, compiler-backed import boundaries, SDK schemas and final real mixed routing. Automated review findings were fixed at their producing owners. Existing exact-base CodeQL alerts are documented on the PR under the owner-authorized unrelated-check exception; no global alerts or security rules were changed.
Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Continue reading Mach-O and Electron ranges after positive short descriptor reads, while preserving explicit EOF, cancellation, file identity and cleanup semantics. Advance fuse scanning and hashing by the bytes actually read.
Validated focused filesystem, Mach-O, dyld, Electron and MCP workflows: 117 tests passed, two Windows-only tests skipped; check:fast passed.
Centralize ELF section and Godot trailer declarations while preserving caller admission policies. Route six PE entrypoints through canonical DOS ownership so relocation data cannot establish a PE header, and update NativeAOT interpretation identity and verifier dependency coverage.
Return the validated descriptor and its original metadata from regular-file
admission. Propagate that contract through owned reads, hashes, snapshots,
artifact inventory and provider file workflows instead of replacing initial
facts with another stat. Keep arbitrary output-handle operations separate.
Preserve final descriptor/path identity proofs, borrowed-source verification,
BigInt precision, cancellation provenance and failed-close ownership. Remove
the obsolete source and owned-ZIP baseline stages and update their consumers
and regressions. Tie read completion faults to actual reads instead of the
retired duplicate stat; instrument real handles without fake handle wrappers.
Validation: fresh runtime/catalog build; focused source, lifecycle, filesystem,
CLI/MCP and authored provider-fixture tests; full static checks; docs checks;
test discovery; duplication check. Platform-specific cases remain skipped on
macOS. No installed provider or device behavior was verified.
Separate AMDGPU processors from feature-qualified note identities. Read Apple hidden ARM64 table rows once and preserve visibility through artifact, dylib and fuse consumers. Keep Objective-C++ template commas within type attributes and incomplete metadata unknown.
Validated provider/parser and production property regressions, Electron CLI/MCP consumers, and native Apple lipo -hideARM64 output through the production slice reader and public artifact inspection. LLVM execution remains unverified.
Fixes#6806Fixes#6799Fixes#6801
Project completed values and cancellation from the descriptor owner once across artifact consumers. Preserve completed void outcomes and format-specific validation and cleanup policies.
Keep later aborts from replacing captured APK and SQLite close failures, and retain the exact APK cancellation reason. Exercise real descriptors, public workflows and cleanup retries.
* fix(hopper): keep macOS and Linux launcher paths POSIX
* fix(hopper): keep Linux and macOS bundle paths POSIX
Linux package archives and macOS app-bundle launcher paths describe the target host, not the host running the test. Build them with path.posix so exercising these installers from Windows produces the same paths as the target platform.
* fix(electron): follow Windows symlink targets with native separators
readlink returns backslash-separated targets on Windows. Splitting only on '/' kept a whole relative target as one component, so nested links were not followed and a relative target could pass the framework-root check without being walked. Split on both separators on Windows and add a regression for an escaping target.
* test(windows): align host-specific path and lifecycle expectations
Compare generated skill and provider-command paths with native joins, bind ADB device-path validation to an explicit platform, and prepare simulated POSIX Ghidra install roots on Windows. Skip POSIX-only Hopper lease, permission-bit, and symlink-parent cases, assert Windows' unsupported Hopper state instead, and cover the Windows Ghidra native-source admission step before snapshot replay. Launch Node child seams with SystemRoot available and expect Windows close-failure resource retention.
* test(windows): close review coverage gaps
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(electron): follow absolute symlinks that stay inside the framework
An absolute symlink target is now passed to relativeInside(root,
target), and a null result still ends the walk as an escape. When the
target lies inside the root, resolved is cleared and the root-relative
pieces are queued on pending, which replaces the path walked so far with
that absolute target. Later hops stay under the hop limit and the
existing lstat containment checks. Provider tests now cover an absolute
Versions/Current that stays on in-framework version B and matches the
relative bundle's resolved path and SHA-256, an absolute Current outside
the framework, and an absolute in-framework link whose next hop leaves
the framework; those last two still surface an escape error.
Fixes#3380
* test(electron): cover absolute framework symlink cycles
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
* fix(errors): name fixed allowances in resource-constraint recovery
Fixed parser, count, report, input, and capture refusals inherited
host-memory, wait-and-retry, or retained-Evidence advice. Producers now
attach allowance-specific recovery, and deterministic capacity caps are
not retryable. IL2CPP reader occupancy stays retryable capacity.
Refs #5556, #5405, #5456, #5459, #5460, #5504, #5505, #5506, #5537, #5628, #5630, #5631, #5632
* fix(il2cpp): keep a closing metadata reader non-retryable
close() stops admission before the active inspection finishes. A second
inspect in that window was projected as retryable capacity. Closing and
closed readers now report capability_unavailable. Occupied readers that
remain open stay retryable.
* fix(errors): align fixed-cap recovery with retained facts
IL2CPP report refusals keep observed source facts instead of denying Evidence. Command-output caps use the capture allowance. Ghidra seed recovery names the limit that was exceeded.
* fix(errors): call byte caps a byte allowance
WASM representation limits and the IL2CPP Ghidra seed-file cap are byte budgets. Their recovery no longer says the exceeded allowance is a fixed count.
* test(ida): keep unresolved procedure lookups non-retryable
Main now treats an unchanged invalid request as non-retryable. The IDA lookup tests follow that projection.
* fix(errors): qualify capture recovery for live output
A fixed capture allowance still rejects the same output. Live captures such as adb logcat can change between requests, so recovery no longer says every unchanged request fails again.
* fix(adb): keep a truncated live capture retryable
Device output can shrink between calls, so an adb capture that exceeds the allowance stays retryable. Deterministic capture and version-output limits stay non-retryable.
* fix(adb): keep truncated mutations non-retryable
Only live observations opt into retrying a capture that exceeded the allowance. Push, install, uninstall, and other mutations stay non-retryable.
* fix(errors): keep live capture recovery off deterministic limits
Artifact-derived capture allowances again say the unchanged request fails. Only volatile adb observations use the live-output sentence.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Adapt the prepared descriptor lifecycle repair from xu91102/rea dbb7db16. Bind exact file cleanup leases, retain typed physical failures and cancellation reasons, and join CLI/MCP finalization and active preflight. Share canonical Evidence construction and retain completed reports across reader handoff cancellation.
Scope active capture admission through shutdown and gate launch after close. Preserve successful descriptor peers and retry only unresolved owners. Separate process/transport retry ownership remains tracked in #4805.
Validation: 168 focused checks passed, one Windows-only skip; built CLI and actual stdio MCP controlled descriptor recovery; build, static and docs checks. No natural OS fault or real Electron launch/teardown claim. Ordinary full replies and Evidence IDs remain byte identical across 30 small CLI tasks.
Fixes#4658
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
Own ELF machine and canonical family in the fixed-header parser. Fuse inspection consumes validated ELF facts and complete COFF machine values while retaining null for unknown or incomplete headers. Binary target, MIPS and Go consumers reuse the parsed facts.
Adapt public CLI controls and fixture builders from #4788; extend x86, ELF byte order, malformed and unknown headers, MCP projection and byte preservation coverage. 430 focused tests passed, one Windows-only skip. Five authored inert fixtures have full actual CLI/stdio MCP Evidence parity; real Linux/Windows Electron apps remain unverified.
Fixes#4786
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
* fix(electron): retain fuse descriptor ownership through failed final close
Static Electron fuse inspection admitted a file descriptor and closed it
in a bare finally: a rejecting final close() replaced the in-flight read
error, was classified by errno (e.g. EACCES) as a read permission failure,
and silently dropped ownership of the still-live descriptor.
Route the read through withOwnedRegularFile so a failed close keeps its
exact owner, preserves the primary error in the outcome, and surfaces as
RegularFileCleanupFailure. The provider now maps that to a primary error
with its own classification plus a ProviderCleanupError reporting
incomplete cleanup, instead of an access-denied read failure.
Regression tests fault close() (EACCES) with and without a primary read
error (EIO): both fail on the pre-fix revision and pass with the fix.
Fixes#4658
* fix(electron): keep cleanup report and partial evidence through cancel and successful reads
Address automated review on #4668:
- Handle RegularFileCleanupFailure before the cancellation check in
failureFor: a cancelled operation whose final close rejects now reports a
typed cancellation composed with the incomplete-cleanup error, instead of a
bare AnalysisCancelledError that silently dropped the descriptor owner.
- Attach the completed fuse image as an explicitly partial Evidence
observation when only the final close fails, instead of discarding the
successful read. The abort-after-completion path keeps the same evidence on
the composed cancellation error.
- Add provider-level regression tests: combined read+close faults, abort
synchronized with the faulted close boundary, and partial-observation
retention. Abort-during-close and partial-evidence tests fail pre-fix.
29/29 electron tests green; npm run check:fast clean.
---------
Co-authored-by: nosmile99 <nosmile99@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Record cancellation at file checkpoints and before owner handoff. Keep physical hash failures, exact reasons, completed facts and failed-close owners distinct through artifact and provider projections and cleanup retries.
Refs #4598. Validated with 566 passing affected tests and 22 platform skips; final Kuna cleanup reason rerun passed 43 tests. No Android device or real JADX/Kuna execution claimed.
Preserve caller-selected POSIX symlink/parent paths during CLI anchoring and
Electron bundle traversal. Resolve terminal directory suffixes through checked
real directories, retaining their identities for before/after readback. Keep
the existing Windows CLI resolution, bounded scan, and output contracts.
Validation: six regressions reproduced on main 7ad75bdc8; 41 focused tests pass
with one Windows-only skip. Full static/docs checks and final main-sync fast
checks pass. Official Electron v44.7.1 release archives, extracted executable
hashes and independent fuse wires verify actual ELF/PE/Mach-O bytes. Real CLI
and stdio MCP reproduce main's wrong target and confirm corrected artifact
identity plus CLI/MCP parity; owned MCP servers exit. Equivalent direct-file
outputs remain 963-1,054 o200k tokens. Individual timing measurements and their
limits are recorded in the PR; no speedup is claimed. Native Windows/macOS REA
execution and target application execution are not claimed.
Co-authored-by: Yann Roberto <165009858+shoyann@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
morluto