Commit Graph
6144 Commits
Author SHA1 Message Date
Ha1baraA1 a965cbab06 fix(ghidra): omit duplicate load-image result (#7777)
* fix(ghidra): omit duplicate load-image result

* docs(mcp): describe load-image evidence projection
2026-10-29 08:23:38 +08:00
64d282b0a6 fix(process): normalize descendants of slash-spelled directory roots (#7803)
* fix(process): normalize descendants of slash-spelled directory roots

A working directory or observation path ending in / or /. kept its
trailing separator as the alias, so descendant paths never met the
delimiter lookahead and stayed literal. Strip those spellings before
building aliases and version the path normalization contract as v3.

Fixes #7584

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(process): normalize filesystem root descendants

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-29 08:23:19 +08:00
RRFZ 30936d7596 fix(managed): report member signature issues at artifact offsets (#7879)
Field, MethodDef and MemberRef signature issues reported the invalid operand's offset inside its blob, while local signature issues in the same coverage array used artifact file offsets. Translate both through one helper that adds the blob's artifact base.

Fixes #7385
2026-10-29 08:23:04 +08:00
ShuaixinHuangandmorluto 3a46047aa7 fix(pe): reject surrogate code units in BMPString names (#7817)
* fix(pe): reject surrogate code units in BMPString names

* chore: preserve base browser imports

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-29 08:20:32 +08:00
morluto 7c5700542e test(reference): pin excluded package main resolution (#7941) 2026-10-29 08:18:13 +08:00
morluto ef9ab91e42 fix(il2cpp): validate retained declaring type relationships (#7946) 2026-10-29 08:16:57 +08:00
morluto 5147b6e306 fix(environment)!: attribute source errors to caller fields (#7900)
* fix(environment): attribute source file errors to caller fields

* style(environment): format source admission tests
2026-10-29 08:12:09 +08:00
morluto c7722c8eeb fix(cli): honor token controls for builtin documents (#7897) 2026-10-29 08:11:19 +08:00
morluto b0b25ad93e fix(ida): report registration timeout bounds (#7893) 2026-10-29 08:11:07 +08:00
morluto 3a512303d9 fix(cli)!: refuse lossy text output (#7852)
* fix(cli)!: refuse lossy text output

* fix(cli): retain failure identity on text refusal

* fix(cli): check failed TOON token windows

* test(cli): bound keyed archive case duration
2026-10-29 08:09:49 +08:00
morluto 794907fa3d fix(javascript): trace boundary results to assigned bindings (#7912) 2026-10-29 07:58:57 +08:00
morluto 2129c17925 fix(native): retain selected Mach-O slice identity (#7940) 2026-10-29 07:57:19 +08:00
morluto 0179d94420 fix(browser): disclose opaque redirect coverage gaps (#7943) 2026-10-29 07:57:00 +08:00
Hasan Zayni bbd4989654 fix(config): treat a blank analyzer override as absent beside an existing Ghidra project (#7923)
REA_GHIDRA_DISABLED_ANALYZERS parses a blank or comma-only value to no override, but the existing-project conflict check tested the raw value. MCP startup exited and doctor reported config_drift for an input that selects nothing. The check now uses the parsed value.

Fixes #7422
2026-10-29 07:56:50 +08:00
Hasan Zayni 32b3722d2f fix(ghidra): report unusable existing-project selections as REA_GHIDRA_PROJECT_PATH configuration errors (#7922)
A selected .gpr marker that does not exist and a target that existing-project mode cannot serve both surfaced as execution_failure with no setting and a doctor action that cannot help. Both now return configuration_invalid naming REA_GHIDRA_PROJECT_PATH. The ENOENT diagnostic of the missing marker is kept.

Fixes #7417
Fixes #7416
2026-10-29 07:56:38 +08:00
morluto 844bb46351 fix(javascript): retain Electron switch conditions (#7910)
* fix(javascript): retain Electron switch conditions

* fix(javascript): bound switch path traversal
2026-10-29 07:56:15 +08:00
morluto 086abf3996 fix(javascript): distinguish bundled script locations (#7909) 2026-10-29 07:56:06 +08:00
morluto 9b4546276c fix(browser): preserve frame tree root identity (#7915) 2026-10-29 07:55:57 +08:00
morluto f256492ff3 fix(apple): recognize AppKit cell ownership (#7916) 2026-10-29 07:55:05 +08:00
morluto 63491645fd fix(ledger): withhold readiness for unresolved evidence (#7928) 2026-10-29 07:54:41 +08:00
Hasan Zayni a4bd924772 fix(call-path): reject incompatible coordinate mappings (#7930)
* fix(call-path): reject incompatible coordinate mappings

Use the existing provider-owned coordinate context comparison before composing dossiers. Preserve same-mapping profiles and missing-dossier uncertainty. Fixes #7345.

* test(call-path): assert the structured rejection instead of its wording

docs/testing.md asks for structured error checks. Assert the issue path and reason, and keep the MCP category and code.
2026-10-29 07:54:09 +08:00
morluto 66f5b650d9 fix(apk): explain unknown signer comparison (#7927) 2026-10-29 07:53:38 +08:00
morlutoandgreptile-apps[bot] 1631dcb09a docs: include Kuna in native provider guidance (#7929)
* docs: include Kuna in native provider guidance

* docs(i18n): include Kuna in native provider guidance

* docs: align provider guide links

* Update README.md

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* docs: align provider links and translated formatting

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-10-29 07:53:28 +08:00
morluto 42d5425417 fix(browser): enforce initial navigation default deadline (#7934) 2026-10-29 07:53:18 +08:00
hhangandhhang 07dfd12613 fix(pe): reject non-MZ inputs before image inspection (#7709)
Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com>
2026-10-29 07:45:32 +08:00
吴佳浩Alben f1da7f7670 fix(javascript): read the spawn env option as Node reads it (#7713)
* fix(javascript): read spawn env as Node reads it

Node's normalizeSpawnArguments starts with `const env = options.env ||
{ ...process.env }`, so a falsy env is replaced by a copy of the parent
environment. A child started with env: null, undefined, 0, "" or false
therefore inherits everything, exactly as if no env were passed.

REA tested the key's presence alone, so every one of those reported
environment_supplied: true and the graph emitted a resolved supplies-env
relation. The presence test also missed the opposite direction: an env
supplied through an inline object spread reported false although Node uses
it.

Read the declared value the way stdioMode already reads stdio: an explicit
property whose statically known value is falsy does not supply an
environment, and an inline spread that carries env does.

Verified on Node v24.22.1 with a child that prints a parent marker variable:
no options, env: null, undefined, void 0, 0, "" and false all print the
marker, while env: {} prints nothing and env: { A: "1" } prints only that.

* fix(javascript): read falsy numeric literals as Node does

greptile flagged that environmentSupplied still reported a supplied environment for
`env: -0` and `env: 0n`: staticJavaScriptTruthiness recognized neither form, so it
returned undefined and `!== false` turned that into true. Node's
normalizeSpawnArguments uses `options.env || { ...process.env }`, so both inherit.

Extend the shared truthiness reader to cover a BigInt literal and a negated numeric
literal, and add regression cases for `-0`, `0n` and `0.0`.

The reader is shared with the route scan and the state tracker; both treat
`undefined` as "unknown", so a more precise `false` only strengthens them.
2026-10-29 07:45:22 +08:00
Wenyu Chiou 3142f7b0dd fix(adb): align CLI selector schemas with canonical inputs (#7722)
* fix(adb): align CLI selector schemas with canonical inputs

Reuse canonical selector constraints for ADB CLI admission and cover schema, parser, and inert provider boundaries. Independent source review approved tree bc722f8d1b1f8d014be29533e6845c6f897d5918; full contribution checks remain pending.

* test(adb): expect CLI serial validation refusal

Independent review approved staged diff 35418e6994339af838b490be51278fd41b9f8e3e. Focused serial refusal test, lint, and formatting passed with existing dependencies.

* test(adb): assert CLI selector validation stage

Independent review approved staged diff a1164a8dcf1df1f0d60323d7a53a69ee2bfdffeb. Focused dispatch tests, targeted lint and formatting passed using existing dependencies.

* fix(adb): retain safe selector validation constraints

Independent review: review_ci_delta APPROVE for diff 18748a3b4b112dc96b95f7c1099bd479e1d1587b. Focused tests, typecheck and targeted lint passed; the aggregate check remains limited by a matching baseline Knip finding.
2026-10-29 07:44:43 +08:00
ShuaixinHuangandmorluto fc24b08851 feat(artifacts): read Zstandard ZIP members (#7780)
* feat(artifacts): read Zstandard-compressed ZIP members

* fix(artifacts): classify ZIP dictionary failures

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-29 07:44:10 +08:00
ShuaixinHuang edc908af58 fix(xml): reject ambiguous namespace attribute identities (#7785) 2026-10-29 07:38:46 +08:00
PARK HYEONMIN (박현민) b4923f85c5 docs(ghidra): count 27 read-only operations in current guides (#7794)
The inventory registry gained read_binary_inventory_summary, so the
read-only inventory is fifteen inventory and twelve function operations.
Update the adapter summary and the Windows lane descriptions to match the
registries the Windows verifier derives its coverage from. The historical
Windows verification record keeps its observed 26-operation count.

Fixes #7611
2026-10-29 07:38:33 +08:00
ShuaixinHuang 9ac9f91ab5 fix(firmware): validate Intel HEX start-record offsets (#7806) 2026-10-29 07:37:39 +08:00
ShuaixinHuang c2cc7e6eb0 test(cli): cover literal Markdown heading output (#7866) 2026-10-29 07:37:20 +08:00
morluto a001231256 fix(adb)!: report local filesystem admission failures (#7885)
* fix(adb)!: report local filesystem admission failures

* test(adb): assert filesystem error provenance
2026-10-29 07:37:08 +08:00
RRFZandmorluto 8c83886891 fix(pe): report exhausted certificate decoder allowances as resource limits (#7881)
* fix(pe): report exhausted certificate decoder allowances as resource limits

A PKCS#7 payload that exhausted the fixed 64 KiB decoded-text or 16,384-value ASN.1 allowance was refused as malformed input with advice to correct request fields. Keep the allowance and limit on the decoder failure and report it as a nonretryable resource_constraint with fixed-allowance recovery.

Fixes #7531

* test(pe): cover certificate allowances through MCP

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
2026-10-29 07:36:56 +08:00
morluto fd297b1b17 fix(apple): preserve bounded archive diagnostics (#7890)
* fix(apple): preserve bounded archive diagnostics

* test(apple): assert diagnostic facts without freezing prose
2026-10-29 07:36:29 +08:00
morluto 16cfe30dab fix(setup): identify invalid launch environment overrides (#7899)
* fix(setup): identify invalid launch environment overrides

* test(setup): cover merged environment recovery
2026-10-29 07:34:43 +08:00
morluto 473cfa36b8 fix(evidence)!: distinguish inline records from bundles (#7895)
* fix(evidence): distinguish inline records from bundles

* fix(evidence): preserve bundle integrity failure reasons
2026-10-29 07:34:31 +08:00
morluto 5082b50f07 fix(decompile): retain limitations across failed resume (#7913) 2026-10-29 07:30:44 +08:00
morluto 31c028f496 fix(mcp): align retained view handoff guidance (#7926) 2026-10-29 07:29:44 +08:00
Hasan Zayni e0719cffa4 fix(ledger): honor every selected fixture proof (#7931)
Prevent a passing fixture entry from hiding applicable failures in another selected entry. Fixes #7412.
2026-10-29 07:27:57 +08:00
morluto 21b192706d docs(website): correct client and IDA support guidance (#7918)
* docs(website): correct client and IDA support guidance

* style(website): format setup support guidance
2026-10-29 05:37:06 +08:00
morluto 286629b570 fix(test): remove duplicate unknown session imports (#7917) 2026-10-29 05:30:05 +08:00
morluto 50d731d456 fix(tests): remove duplicate MCP test imports 2026-10-29 05:19:41 +08:00
morluto f9acfdcf49 fix(cli): retain committed evidence receipts on output failure (#7906) 2026-10-29 05:11:02 +08:00
morluto 9b880e0e3e fix(setup): report concurrent skill destination changes (#7898)
* fix(setup): report concurrent skill destination changes

* fix(setup): avoid rollback after exclusive link refusal
2026-10-29 05:10:45 +08:00
morluto 76c7698ac9 fix(cli)!: preserve native value input diagnostics (#7889) 2026-10-29 05:10:28 +08:00
morluto 83cd1e04c9 fix(javascript)!: report ambiguous artifact paths (#7864)
* fix(javascript): report ambiguous artifact paths

* fix(javascript): retain unavailable colliding sources
2026-10-29 05:10:18 +08:00
morluto 29945d435d fix(process): preserve availability when macOS ownership preparation fails (#7856)
* fix(process): preserve availability when macOS ownership preparation fails

* test(process): verify affected macOS provider availability
2026-10-29 05:10:04 +08:00
morluto 6c205d8a79 fix(evidence): align bundle receipts and conflict recovery (#7849) 2026-10-29 05:09:54 +08:00
morluto 4e663beeb8 fix(javascript): retain guards after labelled breaks (#7841)
* fix(javascript): retain guards after labelled breaks

* fix(javascript): bound labelled exit inspection

* fix(javascript): preserve local break completion

* fix(javascript): avoid exits through unknown control flow

* fix(javascript): retain guards after bounded jump scan
2026-10-29 05:09:45 +08:00