Startup no longer rejects a runtime-owned REA_ seed, so update_analysis_settings can replace it. Debugger construction keeps only the restart-only caps, Kuna stores the launch baseline rather than a cached override, and the advertised operations include GDB close, Rizin close, Kuna list_procedures, and the stable-file ChangeTime callers.
The bridge ceiling lists every Hopper and Ghidra bridge operation plus the Cutter calls, and a test fails when a registry entry is missing. ChangeTime observation and the other launch-seed parsers read an accepted override before rejecting an invalid value.
JEB, Kuna, Windows, debugger, and Cutter consult an accepted override before rejecting an invalid launch value. JEB and Hopper startup deadlines keep default, setting, or runtime as the limit source, and a Kuna timeout without its own limit uses the selected project deadline source.
Startup timeout wrapping keeps the debugger setting limit. Pwntools and Kuna failures report the selected source. Cutter session and command operations can inspect the bridge ceiling.
GDB reads the accepted command-output cap when it admits a command. Cutter uses that same accepted bridge ceiling for mismatch and request checks. Kuna project-timeout metadata includes the operations that wait on the shared export.
Part of #9881. Move the limits checked on each call into update_analysis_settings, keep their REA_ seeds and bounds, and reject updates outside the allowed range.
analysis_timeout_ms, max_heap_mb, and command_timeout_ms keep the source chosen by the caller, the runtime override, or the built-in default. A request value reports update_mode parameter because update_analysis_settings cannot change that call.
Callers read update_mode to see whether update_analysis_settings can change a limit, and pending_restart only when a configured value is not active in this process.
Validate the Evidence owner on every successful dossier before canonical deduplication. Preserve the unowned alias observation in the typed refusal.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Preserve resolution rows while coalescing identical binding tasks before input-index expansion. A 16-target fixture retains one gap group and one argument binding.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Group exact input indices with caller Evidence after complete parameter examination; preserve budget uncertainty and advance the trace workflow profile.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Move binding finalization into one owner; preserve exact callee selectors while indexing retained parameter and return nodes by the dossier address.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
* fix(native)!: enforce paired Swift literal coverage in shared dossiers
BREAKING CHANGE: Retained function dossiers containing only one Swift inventory are rejected. Regenerate observations through a canonical provider; both-absent unsupported observations remain valid.
* fix(contracts): advertise paired Swift literal coverage
* fix(reference): retain proven loader calls and unresolved targets
* refactor(reference): remove unused ancestor lookup
* fix(reference): drop loader calls that return a reassigned member
An immediate call could still use a member's original require initializer
because mutation facts were not built for a call-valued callee. A definite
assignment that precedes the call now replaces that initializer.
* fix(reference): select returned loaders from indexed read facts
* fix(reference): refresh loader facts for wrapped returned members
A sequence such as (0, box.load) still used the original require
initializer. Follow sequence, conditional, and logical returns to the
member before deciding whether a prior assignment replaced it.
* test(reference): record unresolved CommonJS targets in source evidence
unknown.cjs calls require with a non-literal target. The inventory now
keeps that coverage limitation on the file entry, and the boundary
fixture asserts it beside the resolved member relationships.
* fix(reference): cover opaque apply lists and assigned returned members
require.apply(null, args) has no normalized argument list, so the
inventory now records an unresolved target instead of complete coverage.
An assignment return such as f = box.load is followed to the member
before a prior replacement is trusted.
* fix(reference): keep self-defaulted module delegates loadable
Timing a member read at a later call made `box.load = box.load || null` observe its own write and drop the native delegate. Reads that already fed an earlier assignment stay at the member.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(desktop): retain capture identity and cleanup ownership
* fix(desktop): validate destinations and finish inputs before export
* fix(desktop): preserve package ownership and apt trust boundaries
* fix(sqlite): preserve observed facts and distinguish special real values
* fix(desktop): bind computer files to data-object metadata
* test(desktop): count the tagged negative-zero cell spelling
SQLite view cells encode negative zero as a real object so it stays
distinct from the text "-0". The byte budget follows that spelling.
* fix(desktop): keep unresolved discovered state directories
Canonicalizing an unreadable path or dangling symlink aborted capture
before the inventory could record that the path was unknown. Those
discovered directories now keep their absolute spelling in the scope.
* test(desktop): keep the capture scope suite within its line limit
The unresolved state-directory case lives beside the suite so the
existing callback stays within the lint limit.
* fix(desktop): retain cancellation through capture input cleanup
* fix(desktop): avoid reserved Pydantic settings properties
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(javascript): preserve semantic facts across writes and implicit effects
* fix(javascript): preserve bundler identities and helper bindings
* fix(javascript): retain semantic graph evidence and coverage
* test(javascript): include the request link in endpoint traces
Response consumers now also link the originating request to the response, so an endpoint trace reports both that association and the response's json consumer.
* fix(javascript): keep source accessors known after a copied value escapes
An unknown computed getter makes accessor lookup consider every property.
A spread copy already records a value escape, and that escape was treated
as an unknown getter on the source, so the next read escaped the whole
object. Accessor lookup still fails closed for unknown writes and calls.
* fix(javascript): keep Object.defineProperty identified at its own call
The call that escapes Object was treated as a prior replacement of
defineProperty, so a descriptor value never replaced the exported sender
and bundled IPC paths were dropped.
* fix(javascript): keep Vite preload calls that precede reassignment
Helper identity used every write to the binding, so a later assignment
erased a call that had already read the canonical helper. Use the binding
value at the call when that order is known.
* fix(javascript): apply Vite cache mutations before a later reassignment
A later helper write made the whole-binding initializer check ignore an earlier cache mutation. Identity at that mutation uses the same ordered read as the call.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(setup): retain Hopper operation failure attribution
* fix(setup): retain falsy Hopper abort reasons from body reads
After response headers, Node's fetch body reader rejects a null, false,
0, or empty-string abort with a fresh AbortError instead of that reason.
Replace that substituted error with the caller's reason. A body
AbortError while the caller has not aborted still propagates.
* fix(setup): preserve independent response body aborts
* fix(setup): identify aborts through owned transport
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(api-contract): retain partial OpenAPI evidence
* docs(api-contract): describe partial OpenAPI Evidence on interruption
Early failures still keep the file snapshot hash. Cancellation or the
retained-facts limit after a row now returns authenticated Evidence, and
the guide explains how to reuse that partial inventory.
* fix(api-contract): count finished paths and keep earlier diagnostics
A path counts only after its item is read, so a path refused before
traversal does not increase path_entries_examined. A paths diagnostic
that exhausts the retained-facts allowance still keeps diagnostics
already stored, including invalid info.
* test(api-contract): keep invalid info when paths exhaust the allowance
The paths diagnostic can fail after invalid info is already stored. The
partial report must still carry that diagnostic and count no path entries.
* docs(api-contract): name every retained row and the view source
The hash remains only when no operation, reference, or diagnostic row was
kept. Partial Evidence is reread through inspect_analysis_view's source
and view, not as separate Evidence fields.
* test(api-contract): verify interrupted inventory evidence
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(adb): reject unrepresentable activity arguments
* test(adb): lock complete activity component boundaries
The CLI and advertised schema still admitted a slash-free 512-character
component after admission required a nonempty package and class. Keep
that length sample rejected, admit a pattern-valid 512-character
component, and assert the typed field error.
* style(docs): format NTFS verification tables
oxfmt rejects the tables merged from main. The alignment is formatting
only, so static checks can run on this branch.
* test(adb): use a well-formed component for the length constraint
An over-long run of letters also fails the package/activity pattern, so the selector check reported both issues. The length fixture now has a valid component shape.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(elf): keep compressed storage out of decoded metadata facts
* fix(elf): admit compressed string tables the profile does not read
SHF_COMPRESSED string tables are rejected only when they name sections
or symbols. An unreferenced string table is not decoded, so it no longer
makes an otherwise analyzable ELF unsupported.
* fix(elf): keep requirement names when verdef declares no entries
A compressed GNU version-definition section with sh_info 0 has no
definitions to decode. Skipping it leaves requirement names in place
instead of clearing them as an unread compressed table.
* fix(elf): skip empty version requirements before storage reads
* fix(elf): skip empty compressed version-requirement tables
A GNU verneed section with sh_info 0 has no requirement records. Reading
its compressed bytes was a version failure and partial coverage; the
declared count now skips that read.
* fix(mips): distinguish compressed metadata storage (#9959)
* fix(elf): note a missing symbol table only when a relocation needs it
A sectionless image with direct DT_INIT and DT_FINI no longer becomes incomplete solely because DT_SYMTAB does not match a decoded table. The same note remains when a dynamic relocation asks for a symbol.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(native): bind initializer evidence to selected Mach-O slices
* fix(native): reject initializer slices outside the artifact
* test(native): retain completed initializer evidence on late cancellation
completeProviderEvidence keeps the finished report on
AnalysisCancelledError.partialObservation and the caller's abort reason.
The regression only checked the error tag, so dropping that evidence
would pass. Restore both structured assertions.
* fix(native): bind initializer facts to the selected slice label and range
A universal report could keep an arm64 cpu_type beside an x86_64 slice
label, and entry file offsets only had to fall inside the container.
Require the slice architecture to match the request, and require each
slot and value file offset to lie in that slice.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix(cli): retain cancellation observed during final cleanup
* fix(cli): cancel reference source imports through cleanup
* fix(cli): preserve signal status through command logging
* fix(views)!: distinguish unavailable artifact collections
Keep missing BEAM tables and unavailable Go and Rust build metadata
separate from decoded empty collections. Retain producer limitations
on model metadata, tensor, and type pages.
BREAKING CHANGE: BEAM, Go, and Rust analysis view pages for unavailable
collections now report coverage.status "unavailable", coverage.total
null, and coverage.exhausted false. Refresh saved result schemas and
handle unknown totals before using coverage to infer absence.
* test(views): expect unavailable Go dependency pages
Missing Go build metadata is unavailable coverage, so the MCP page reports a null total instead of an empty collection.
* test(fixtures): ignore a torn build-computer note line
The cancellation test reads the helper's note file while the append is
still in progress. An empty file or an unfinished last line is not a
record yet. A completed line still has to parse.
* fix(fixtures): reject terminated malformed build-computer notes
Trim removed the final newline, so a completed corrupt record looked like
a torn append and the preceding notes were returned. Keep the terminator
and parse every finished line.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Cursor Agent