* refactor(process): own deadlines as one monotonic type with a finalize budget
Deadline (src/domain/deadline) holds a monotonic work budget and a separate finalize budget that starts when finalization begins. ProviderStartupDeadline is built on it and exposes finalize(), so a failed Ghidra startup drains launcher output under its own budget and the caller's signal instead of the expired startup signal. The six wall-clock deadline sums in src move onto Deadline; a counted guard keeps the one page-clock conversion and rejects new copies.
* refactor(process): share one finalize window across repeated beginFinalize calls
* fix(cutter)!: report undeclared output truncation and document generation as unknown
cutter_command filled a missing output_truncated with false and a missing
document_generation with the caller's expected_generation, so a reply that
did not declare them read as "nothing omitted" and "document unchanged".
Both are now null when the plugin did not declare them, with an Evidence
limitation for each. A command that never started still reports
output_truncated false, because there was no output to omit. The packaged
plugin now declares output_truncated on every command reply and the current
generation on its not-started replies.
BREAKING CHANGE: cutter_command's result fields output_truncated and
document_generation are now nullable. A caller that read document_generation
as a number must handle null by listing Cutter sessions again before choosing
an expected_generation. A caller that read output_truncated as a boolean must
treat null as "the output may be incomplete".
* test(cutter): cover the unknown-truncation limitation
* feat(cutter): identify the running plugin's source and refuse a modified one
The Cutter plugin now publishes the SHA-256 of its own file on its session
descriptor (an additive field). Discovery reports each session's
bridge_source as packaged, modified, or unknown (an older plugin without the
field). cutter_command refuses a modified plugin before sending anything and
names the packaged plugin to copy into Cutter's plugins/python directory.
* fix(cutter): report an unreadable packaged plugin instead of hiding the live session
* test(cutter): give the discovery fixture sessions their bridge source
* fix(artifacts): honor record-and-continue for lipo and FAT slice disagreement
* fix(artifacts): keep recovered slice names distinct, lipo field evidence, and unknown coverage without a FAT parse
* fix(artifacts): keep lipo's unnormalized CPU declarations when FAT ranges are authoritative
* fix(process): stop execFileOutput's process group, not only its root
* test(process): cover group escalation and abort the launcher on failed readiness
The session map, start reservations, the shared in-flight stop, retained cleanup failures, cleanup retry and close-all move into OwnedDebuggerSessionRegistry. Each debugger keeps its protocol, detach and stop-reason policy and supplies only its seal and stop hooks.
* fix(plist): record dictionary keys declared more than once before decoding collapses them
* fix(plist): bound repeated key names in the limitation and mark only real omissions
* fix(il2cpp): report the exceeded native-link maximum in the public refusal
* fix(il2cpp): report each native-link budget's maximum in the unit its producer counts
* refactor(elf): report pointer relocation failures through ParseFailure (#10748)
NodeHttpRequestOwner.drain() reported a failed response-source finalizer as a transport resource constraint, which reads as a budget the caller could raise. It is retained cleanup, so drain now throws a ProviderCleanupError with cleanupIncomplete and the retained resource, and the file leaves the typed-resource-refusal baseline.
Add a jsonText declaration to the contract command description: a
structured contract field is taken as one JSON text argument, decoded at
argv parsing, and admitted by the contract field's own schema, so
--schema advertises the contract's structure. This generalizes the
per-command producerLimitsOption wiring.
Migrate inspect-binary-layout and inspect-recorded-crash (producer_limits
as JSON text; recorded-crash keeps --debugger-context for
include_debugger_context) and delete their hand-written options and input
spreads.
The parity guard probes JSON-text fields with valid, malformed and
contract-refused JSON.
* refactor(application): own the finalization precedence in runOwned
runOwned runs owned work, closes its owner and applies the documented
precedence once: a recorded failure stays primary, cancellation before
commit keeps the completed value as a partial observation, cancellation
after commit keeps the value, and unconfirmed cleanup reports
cleanup_incomplete while keeping the completed value. finishAnalysisCommand
now projects its Finalized outcome; its 31 callers are unchanged.
* fix(application): preserve finalization outcomes
* fix(application): classify finalization by the primary error and keep cancellation through recovered publication
A producer composite whose primary is a cancellation finalized as failed because the kind read only the top-level error class; it now follows primaryAnalysisError. A cancellation that arrived while a recovered value's publication failed was dropped because the signal was read before that last await; it is now attached to the publication failure as a secondary.
* fix(cli): keep the initial failure snapshot whenever close itself succeeded
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
* refactor(hopper): build Hopper cancellations with a required reason
Migrate the remaining AnalysisCancelledError constructions under
src/hopper to cancelledBy. Regex-search close aborts its workers with
OwnerCancellation.ownerClosed. HopperCleanup and HopperClient are not
touched.
* test(hopper): cover cancellation during search shutdown
* fix(pcap): report a refused tool launch as an unavailable tool
When a capture read's tool launch was refused with EPERM, pcap reported it
as unreadable tool output (AnalysisProtocolError) instead of an unavailable
tool. Pcap also never told "not executable" apart from "missing".
Add classifyLaunchFailure in src/process as the one owner of which spawn
errnos mean missing (ENOENT, ENOTDIR) and which mean present but not
executable (EACCES, EPERM, ENOEXEC, EISDIR). Pcap, apktool and gdb used three
different errno lists; all three now use it.
* refactor(process): classify Java and adb launch refusals with the shared owner (#10598)
The Ghidra and JADX Java probes and adb's version probe now take
missing-versus-not-executable from classifyLaunchFailure instead of their
own errno checks. ELOOP and ENAMETOOLONG join the owner's missing set, so
adb keeps its existing classification and both Java probes now treat a
non-directory path component as a missing runtime.
* fix(pcap): preserve command launch attribution
* test(pcap): expect an unknown failing stage when a limited capture tool exits unsuccessfully
* fix(pcap): attribute a limited capture's exit through the prlimit wrapper
* fix(process): identify the refused executable for every launcher shape
Name the executable on errnos Node throws synchronously from spawn
(ENOEXEC, ENOTDIR, ...) and read the Windows native launcher's
executable-launch constraint, so pcap attributes those refusals to the
selected tool or limiter instead of an unknown stage.
* test(pcap): prove synchronous launch naming with ENOTDIR on every POSIX host
* fix(hopper): name the failing fields when a bridge reply misses its contract
* fix(ci): run the package baseline when the fake Hopper bridge changes
* fix(hopper): name nested union failures and cover every native schema in the package scope
* refactor(parsers): report format failures through one ParseFailure algebra
Add ParseFailure (malformed, truncated, unsupported, limit, with format,
offset and field) and its one carrier, ParseFailureError, in the domain.
BinaryReader now names truncation and the field it read, and its native
format and resource failures are ParseFailureError subclasses.
Providers projected a format failure with their own instanceof ladder,
and some dropped the selected path from the invalid_format message.
parseFailureAnalysisError now owns that projection for the native,
Go, devicetree, V8, Windows Shortcut and Electron fuse providers.
The V8 code cache, Windows Shortcut and Electron fuse format classes
are removed in favour of the algebra.
The architecture guard counts raw Buffer and DataView reads, plain
Error throws in parser folders and plain JSON.parse of parser input
against baselines that can only shrink.
* fix(parsers): stop reading every RangeError as a format failure
Mach-O, Swift and Objective-C metadata parsers threw RangeError for a
truncated or malformed record, so their catch sites treated any
RangeError as a partial decode: a call stack overflow or a host string
limit became an "unresolved" metadata reason, and the IL2CPP Mach-O
path reported it as a malformed container.
Those parsers and the CIL method body reader now throw ParseFailureError.
hostRangeErrorKind is the one interpreter of a host RangeError (stack
overflow, host capacity, raw out-of-bounds read), and
parseFailureFromCause admits only a parse failure or a raw
out-of-bounds read as evidence about the input. Fixup stream catch-alls
rethrow host limits. The architecture guard counts the remaining direct
instanceof RangeError checks.
* fix(parsers): preserve Apple metadata failure ownership
* test(architecture): shrink parser failure baseline
* fix: preserve uncertainty for host range errors
* fix(artifacts): classify ELF and thin Mach-O only when their headers decode
Inventory classified a file as elf or mach-o on its magic number alone,
while target resolution requires a decodable ELF fixed header and a
walkable Mach-O load-command table. A magic-only stub or a Mach-O with
corrupt load commands was inventoried as an executable that open_binary
then refused. Both routes now share readNativeHeaderFormat; such files
are classified unknown.
* test(applications): give mobile application fixtures decodable native headers
Inventory now classifies ELF and thin Mach-O only when their headers decode, so the 8-byte magic stubs in the Android and Apple application fixtures no longer count as native code. Use the shared minimal header fixtures instead.
SourceMapFormatFailure and its format/unsupported/limit/section-overlap reasons are replaced by ParseFailureError with format source-map. Limits carry the selected allowance name and maximum; a section-boundary overlap is a malformed failure on the section-boundary field. The codec reply protocol and every public error are unchanged.
* fix(browser): type CDP command replies and parse frame trees once
CdpConnection.send is typed by method name. A command registered in
src/browser/protocol/CdpCommands.ts has its parameters typed from the
protocol table Playwright ships and its reply parsed once by its own result
schema; a mismatch rejects that command with CdpMalformedReply
(protocol_error, command, JSON pointer) without poisoning the connection.
Playwright storage sessions admit replies through the same table.
Page.getFrameTree and Page.getResourceTree are the first registered
commands. Their one parser keeps per-frame facts tolerant (malformed child
entries remain explicit omissions) and replaces the per-site readers:
observeMainFrameUrl, mainFrameUrl, walkFrameTrees, frameTreeResources,
runtimeFrameTreeSchema and the scenario storage frame schema.
A reply without a frame tree used to be retried for two seconds and
reported as target_not_allowed; it is now one protocol_error.
A guard test counts literal CDP command names without a result schema per
source file; the baseline can only shrink.
* fix(browser): consume parsed CDP facts across boundaries
* refactor(browser): register target, storage and acknowledgement CDP replies
Register result schemas for Target.attachToTarget, Target.getTargetInfo,
Storage.getStorageKey, Page.addScriptToEvaluateOnNewDocument,
Debugger.setBreakpointByUrl, Debugger.evaluateOnCallFrame and fourteen
commands whose reply REA reads only as success. Their callers use the
parsed reply; the per-site readers are removed (attachedSessionId and the
scenario storage and service-worker zod schemas, which threw raw ZodError).
Playwright's Target.getTargetInfo in scenario attach now goes through the
same admission. The untyped-command baseline drops from 96 to 48.
* fix(browser): report malformed script source and coverage replies as protocol errors
* fix(browser): type DOM listener, metrics and emulation CDP replies
* fix(browser): report malformed script source and coverage replies as protocol errors (#10638)
Migrate inspect-go-binary, inspect-v8-code-cache, inspect-devicetree and
inspect-native-exports onto the contract command description and delete
their hand-written options and input spreads.
The description gains evidenceDelivery. It adds the shared --detail and
--evidence_output options, and the run context carries the selected
delivery. A contract detail field selects that delivery and is not passed
to the analysis, as the hand-written commands did. Go's cross-field
budget rules stay with the service's contract parse, so standalone
--max-string-literals still returns invalid_request.
The parity guard accepts the declared CLI-only delivery options as the
only options without a contract field.
IDA's processor-neutral callgraph reader reported coverage complete when
upstream omitted the truncation flag or the per-function cap. Cutter
reported a command complete when a successful reply omitted
execution_state. Both now report unknown, so an omitted marker is never
read as a declaration of completeness.
parseMcpJsonOrText returned the raw string whenever JSON.parse failed, so a
truncated JSON reply from IDA or JEB became an ordinary string and IDA's
legacy decompile_function accepted it as pseudocode. Text blocks are now
decoded by the tool's declared reply kind: JSON unless the tool returns
plain text (IDA legacy decompile_function). Malformed JSON is a typed
protocol failure.
* fix(javascript): expose operands of unmodelled implicit execution
The member-mutation collectors now escape the operands of every execution
kind they did not apply: yielded values, JSX element operands, dynamic
import specifiers and options, decorated classes, with-statement scope
objects, iteration inside accessors and syntax the classification does not
describe. Each of these left a literal where the equivalent explicit call
already yields unknown.
Decorators are classified at the class definition that calls them and are
evaluated as definition-time expressions.
* fix(javascript): expose decorated instance members and keep a decorator's outer this
A class's decorator execution now exposes decorated members' functions and initializers, which a decorator can call without the class running them. The getter receiver walk uses the shared javaScriptDefinitionExpression owner, so class and member decorators see the enclosing this like heritage and computed keys.
* test(architecture): ratchet top-level layer direction and mutual imports
Declare a layer for every top-level src/ directory and root source file
(domain, contracts, foundation, providers, application, composition,
adapters) in scripts/lib/module-layers.mjs. verify:module-boundaries now also
builds the production import graph between those units and compares it with
a counted baseline: 45 unit pairs import a higher layer (248 imports) and 23
unit pairs import each other. A new upward pair, more imports on a recorded
pair, a new mutual import, or an undeclared unit fails; shrinkage is
reported so the baseline can be lowered.
* fix(architecture): enforce layers for isolated units
* fix(ghidra): carry only the latest launcher output in error diagnostics
Ghidra retains up to 8 MiB of launcher output so it can scan for failures,
and every error projected all of it into details.diagnostics. A startup
timeout on a large binary produced an 11 MB error payload (#10365).
Project the last 64 KiB of each retained stream, the bound gdb, rizin and
native commands already use, and record text_bytes next to the existing
observed and retained byte counts. Redaction runs on the whole retained text
before the cut. Add utf8TailExcerpt as the shared helper that keeps the end
without splitting a character.
Refs #10365
* fix(ghidra): preserve actionable launcher diagnostics
* test(ghidra): keep launcher scenarios independently scoped
* refactor(ghidra): parse launcher failures once in the diagnostics owner
ghidraFailureOutput parses every retained line with the single launcher-failure parser and carries bounded, redacted facts with their source line. The error projection reads those facts instead of re-scanning stream text, and the superseded line filter and ghidraJavaHomeSaveDenial text scanner are removed.
* fix(setup): stop writing the default compact input profile for Kimi and LM Studio
The server already advertises compact input schemas when
REA_MCP_INPUT_SCHEMA_PROFILE is unset, so setup no longer adds that value to
Kimi Code and LM Studio registrations, and doctor/status no longer report a
registration without it as stale. Explicit stored or setup-environment
profiles are still preserved.
Refs #10514
* fix(setup): validate LM Studio registration environment
* test(hopper): retry cleanup after confirmed application exit
Inventory classification and binary target resolution each kept their
own ordered chain of container sniffers (iNES, ZIP, Godot PCK, UnityFS,
wxapkg, uImage, HEX/S-record, UF2, DfuSe, ESP flash and image, FIT,
NTFS MFT, binary plist). Both now walk ARTIFACT_FORMAT_RECOGNIZERS in
src/domain/artifactFormatRecognition.ts.
A recognizer reports recognized, refused (the header names a format
this file cannot be read as) or needs-input (the DFU trailer or an ESP
flash layout). Each route keeps only its policy: resolution reads the
trailer or locates the flash layout on demand and refuses with
file_format_rejected; inventory falls through on a refusal or a missing
input, as before.
* refactor(errors): type 14 baselined resource refusals as fixed ceilings or measured exhaustion
Fixed ceilings (NTFS journal file, web-bundle worker transfer, Playwright trace parser, lipo field retention, exactly representable file sizes) now name their allowance; observed heap or result-capacity exhaustion and occupied admission declare measuredExhaustion. The typed-resource-refusal baseline drops from 24 sites in 19 files to 10 in 10.
* fix(browser): name the trace parser allowance the record actually exhausted
* test(ntfs): compare the oversized-acquisition recovery with its owning formatter
The Java bridge answered an unparseable request with a fixed id 1 and
closed the connection. The client ignored that reply because id 1 was
already settled, so the caller saw a socket-close process failure instead
of invalid_request. The bridge now reserves id 0 for connection-level
failures, and the client fails the request in flight with the remote
reason (or reports a protocol failure when nothing is in flight).
* fix(hopper): validate inventory replies against their contracts at the provider edge
Hopper validated only the response envelope. list_names replies outside
the inventory contract were returned unchanged (projectHopperNameInventory
passed them through), and the regex search re-parsed its inventory with
its own policy. A per-method reply contract table built from the shared
native inventory schemas now validates list_names, list_procedures,
list_strings, search_procedures and search_strings once; a reply outside
the contract is an AnalysisOutputError. The remaining 31 operations are a
counted pending list that may only shrink.
* fix(hopper): add reply contracts for scalar, boolean and address-list operations
Twenty-two more Hopper operations are validated against reply contracts
built from the shared native schemas. The pending list shrinks from 31
to 9 operations.
* refactor(hopper): validate every bridge reply through one contract table
The reply table now covers every bridge method REA reads, including the
private caller-reconciliation methods. HopperFileOffset receives a
validated observation and HopperCallerReconciliation reads typed replies
instead of keeping its own schemas and re-parsing the native result. The
segment list schema moves from contracts into its domain owner.
* fix(hopper): apply reply contracts on the ready path and test every entry path
executeIfReady validated only list_procedures, so a malformed
list_documents reply could reach the completion path. Every contracted
operation is now validated there, and provider-level tests cover the
direct and ready paths for each inventory and document operation.
* refactor(model): report GGUF and Safetensors format failures through ParseFailure
* fix(model): report malformed model headers as invalid_format through the shared mapping
Malformed and truncated GGUF and Safetensors headers now take the shared ParseFailure mapping (invalid_request, invalid_format on path) instead of the model provider's own BinaryTargetError file_format_rejected. Unsupported forms stay unsupported_target and model allowances keep their resource-constraint recovery.
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(android): build mobile-provider cancellations with a required reason
Migrate every remaining AnalysisCancelledError construction under
src/adb, src/android, src/apktool, src/apkSignature, src/flutter,
src/il2cpp, src/dotnet and src/frida to cancelledBy and lower the guard
baseline from 671 to 608. A closed adb provider reports
OwnerCancellation.ownerClosed for later probes, and JADX and apktool
shutdown abort with that typed reason.
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
* docs: refuse literal tool counts in living prose
docs:check now refuses a count of ten or more tools in README, AGENTS,
CONTRIBUTING, docs/ (except dated releases, specs, verification and ADR
records), the authored skill and the public website. The catalog owns that
number and every hand-written copy goes stale when a tool is added. The three
current statements (240, 172 and 254 tools, all measured on earlier builds)
now refer to the catalog of the measured build instead.
* fix(docs): exclude generated pages from prose checks
* fix(docs): rerun the tool-count check when any scanned prose changes
The docs:check:built cache inputs and the CI docs lane did not cover AGENTS.md, CONTRIBUTING.md, every .agents/skills tree or website/public, so an edit there could reuse a cached pass or skip the docs job. The scanner now owns one isLivingProsePath predicate; the CI plan selects the docs lane with it, and a test binds the turbo inputs to the scanned roots.
Hopper and native dispatch metadata re-ranked FAT slices from the target's
architecture name instead of reading the admitted universalSlice. Both now
consume the admitted range and refuse when it is missing or undeclared.
Mach-O load-command codes move to one table with an architecture guard.
fix(gpu): report malformed GPU containers as invalid_format through the shared parse-failure mapping
GpuCodeObjectsProvider mapped a malformed BinaryFormatFailure to a
BinaryTargetError (target_unavailable / file_format_rejected) while every
other format parser reports malformed bytes as an invalid path
(invalid_request / invalid_format). It now uses parseFailureAnalysisError.
* fix(browser): type CDP command replies and parse frame trees once
CdpConnection.send is typed by method name. A command registered in
src/browser/protocol/CdpCommands.ts has its parameters typed from the
protocol table Playwright ships and its reply parsed once by its own result
schema; a mismatch rejects that command with CdpMalformedReply
(protocol_error, command, JSON pointer) without poisoning the connection.
Playwright storage sessions admit replies through the same table.
Page.getFrameTree and Page.getResourceTree are the first registered
commands. Their one parser keeps per-frame facts tolerant (malformed child
entries remain explicit omissions) and replaces the per-site readers:
observeMainFrameUrl, mainFrameUrl, walkFrameTrees, frameTreeResources,
runtimeFrameTreeSchema and the scenario storage frame schema.
A reply without a frame tree used to be retried for two seconds and
reported as target_not_allowed; it is now one protocol_error.
A guard test counts literal CDP command names without a result schema per
source file; the baseline can only shrink.
* fix(browser): consume parsed CDP facts across boundaries
* refactor(browser): register target, storage and acknowledgement CDP replies
Register result schemas for Target.attachToTarget, Target.getTargetInfo,
Storage.getStorageKey, Page.addScriptToEvaluateOnNewDocument,
Debugger.setBreakpointByUrl, Debugger.evaluateOnCallFrame and fourteen
commands whose reply REA reads only as success. Their callers use the
parsed reply; the per-site readers are removed (attachedSessionId and the
scenario storage and service-worker zod schemas, which threw raw ZodError).
Playwright's Target.getTargetInfo in scenario attach now goes through the
same admission. The untyped-command baseline drops from 96 to 48.
* refactor(cli): derive contract-backed command options from the tool contract
Each contract-backed CLI command restated its contract's input fields as
hand-written incur options and mapped them back to snake_case input with
conditional spreads. Nothing checked that the two schemas agreed.
Add registerContractCommand: a per-command projection names only what the
CLI spells differently (positionals, caller-relative path fields, option
renames, CLI help wording, omitted optional fields with a reason). Option
schemas, decimal argv tokens and the contract's cross-field rules are
derived from the contract input schema, and parsed options map back to the
contract input mechanically.
Migrate inspect-sqlite-database and the thirteen flat binary-diagnostics
inspectors. Their --schema output is unchanged apart from property order,
and help lists options in contract order. Delete the SQLite superRefine that
mirrored the contract and the per-command spreads.
Add a parity test: every projected command exposes each contract field or
declares its omission, and each field admits exactly what the contract
admits for empty, NUL, relative-path, bound and numeric-spelling probes.
* refactor(cli): refuse unprojected contract input forms at registration
Address review findings on the contract projection:
- Bind inspect-sqlite-database to its contract by name instead of catalog
position.
- Accept only field forms argv can carry (string, number, boolean, enum,
and arrays of strings or enums) instead of rejecting a short list, so
arrays of objects, tuples and other forms fail at registration.
- Refuse root input keywords other than the projected object constraints
and presentation annotations, so a contract rule such as `not` cannot
disappear from --schema.
* refactor(cli): describe contract commands independently of the CLI framework
Split the contract projection into a framework-neutral description and a
thin Incur adapter, so a later REA-owned CLI layer (#10583) can render the
same description.
- contractCliDescription.ts derives each positional and option from the
contract and projection: key and short flag, help, argv admission
schema, boolean-flag/repeatable/decimal/caller-path facts, object
constraints renamed to CLI keys, the optional argv-time cross-field
check, and the mapping back to contract input.
- contractCommand.ts only renders that description as Incur args and
options and runs the handler.
Cross-field rules now refuse at argv parsing only when a projection asks
(inspect-sqlite-database does, keeping its behavior); otherwise the
service's contract parse refuses them as before. Exact-optional fields are
projected as optional because argv cannot carry an explicit undefined and
Incur's help reads flag and choice types only through optional.
The parity guard reads the descriptions, and also checks that boolean
fields parse as bare flags and that no projected field stays
exact-optional.
* refactor(rust): report cargo-auditable section failures through ParseFailure
RustAuditableFormatFailure restated the malformed/unsupported algebra and
the provider translated it by hand; container BinaryFormatFailures were
re-wrapped and lost their kind. The reader now throws ParseFailureError
(format rust-auditable), container failures propagate unchanged, and the
provider maps both through parseFailureAnalysisError. A counted guard
keeps new per-format failure classes from returning.
* test(rust): pin the container's truncated failure facts through the Rust reader
* fix(browser): type CDP command replies and parse frame trees once
CdpConnection.send is typed by method name. A command registered in
src/browser/protocol/CdpCommands.ts has its parameters typed from the
protocol table Playwright ships and its reply parsed once by its own result
schema; a mismatch rejects that command with CdpMalformedReply
(protocol_error, command, JSON pointer) without poisoning the connection.
Playwright storage sessions admit replies through the same table.
Page.getFrameTree and Page.getResourceTree are the first registered
commands. Their one parser keeps per-frame facts tolerant (malformed child
entries remain explicit omissions) and replaces the per-site readers:
observeMainFrameUrl, mainFrameUrl, walkFrameTrees, frameTreeResources,
runtimeFrameTreeSchema and the scenario storage frame schema.
A reply without a frame tree used to be retried for two seconds and
reported as target_not_allowed; it is now one protocol_error.
A guard test counts literal CDP command names without a result schema per
source file; the baseline can only shrink.
* fix(browser): consume parsed CDP facts across boundaries
* test(mcp): check advertised schemas against a portable dialect in every profile
* fix(mcp): validate advertised dialect by selected profile
* fix(mcp): refuse zero-padded repeat bounds and record host-specific path patterns
* refactor(errors): require a reason for every analysis cancellation
Add cancelledBy, the one constructor for AnalysisCancelledError. Its
reason argument is required: an aborted signal, an earlier cancellation,
a reason carried from an inner failure, or an OwnerCancellation when REA
closed the work's owner itself.
Closed adb, apktool, firmware, sqlite, gdb, web-bundle analyzer and
binary-session record owners now report OwnerCancellation.ownerClosed
instead of an absent reason. Firmware's predecessor wait returns its
cancellation as a Result, removing an unreachable reason-less fallback.
An architecture guard rejects new direct constructions, with a counted
per-file baseline that can only shrink.
* refactor(errors): share one aborted-signal predicate with cancelledBy
* refactor(process): return a departing caller's reason from a shared startup wait
* refactor(providers): build decompiler-provider cancellations with a required reason (#10587)
Migrate every AnalysisCancelledError construction under src/ghidra,
src/ida, src/cutter, src/jeb and src/kuna to cancelledBy and lower the
guard baseline from 671 to 572. Closed Kuna target commands report
OwnerCancellation.ownerClosed instead of an absent reason, and Kuna and
JEB close abort their lifetimes with that typed reason.
* fix(errors): read the reason of any signal-shaped cancellation source
* test(ci): cover the counted-baseline comparison behind the architecture guard
morluto