* refactor: prune internal seams and preserve configuration ownership
* fix(setup): keep YAML aliases and inherited registration settings on refresh
- Reuse an unchanged YAML collection only while every alias in it still
resolves after the edit; otherwise rebuild it so the alias becomes its
value. A sibling anchor replaced or moved in the same refresh no longer
leaves an unresolved alias in Hermes or Goose output.
- Keep a connection selector whose existing value already chooses stdio
(for example an inherited Hermes transport: stdio) instead of superseding
it; remote selectors are still replaced. Explicit stdio selectors are
therefore no longer rewritten (Kimi expectation updated).
- When the whole Hermes registration is inherited through a merge,
override it with that merge and write only the changed fields.
* fix(setup): edit registration fields whose YAML key is an alias
A key written as an alias to a string scalar (for example *field with
field: &field env) was treated as a source-only key, so any change to
its value was refused in Hermes and Goose. Resolve such keys to their
string, keep the aliased spelling while its anchor survives the edit,
and write the plain key when the same edit rebuilds the anchor.
* test(process): bound cleanup-boundary waits and always release gates
Both cancellation tests awaited a bare started promise and released
their gates only on success, so a missed boundary waited for the outer
deadline and could leave cleanup parked. Use awaitAcknowledgement and
release and join the cleanup in finally.
* fix(setup): repair only aliases an edit leaves unresolved
Replace the pre-edit alias survival guess, which expanded aliases to
sibling anchors that survive unchanged, with an exact repair: record
what each alias in the replaced value resolves to, write the edit, then
replace only aliases left without a preceding anchor by that value.
- Keep an aliased key's source position, so its anchor stays ahead of
later aliases.
- Treat an aliased key as its string only when no other key in the map
resolves to the same string; an ambiguous one stays guarded.
- Override an inherited Hermes registration only when the requested
entry keeps every inherited field, so an explicit replacement can drop
remote selectors.
* fix(setup): repair aliases whose binding an edit changes, keeping comments
An alias whose own anchor was removed could resolve to an earlier anchor
with the same name and silently change value. Record the node each alias
resolved to and repair any alias that no longer resolves to that node.
Carry the alias's comments and spacing onto the repaired value.
* test(setup): split the Hermes anchor and merge refresh cases
* fix(setup): refuse removing an overridden key its merge would restore
The merge-retention check skipped keys the mapping also overrides, so
dropping such a key (for example a remote url during an explicit stdio
replacement) let the retained merge restore it. Check removal before
skipping overridden keys, so the edit is refused with the existing
message instead of producing a registration that cannot be applied.
Explicit deadlines at or below the project deadline only shortened it:
a literal 30-second value also disabled the coverage scaling, which timed
out wide-capacity regressions on main. Workloads above the built
deadline use the long-running tag. Deadlines derived from an operation
budget remain.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(native): list ELF initializers of images with COPY relocations
inspect-native-initializers reported every init_array and fini_array slot
of a non-PIE executable as unresolved, and ordinary PIE executables as
incomplete, when the image carried a COPY relocation such as the one for
stdout.
The shared dynamic relocation reader had no write extent for COPY or TLS
descriptor relocations, so one such record made pointer coverage unknown.
It now sizes a COPY from the image's own dynamic symbol and a TLS
descriptor as two words. COPY sizes are accepted up to the file byte count
in total, so repeated records cannot multiply consumer work.
The section relocation fallback also treated a record whose destination
has no file bytes, as COPY into .bss does, as an unread table. A linked
image's record now affects only the slots it overlaps in memory.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YT2WLf5G9AnLKF3bZtNLwf
* test(native): cover a COPY relocation against symbol index 0
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YT2WLf5G9AnLKF3bZtNLwf
* fix(native): size section COPY records and keep write extents opt-in
Address two review findings on the COPY relocation change.
The shared dynamic relocation reader yields COPY and TLS descriptor
records as writes only to a consumer that asks for whole extents. The
initializer walk asks. IL2CPP and the Android JNI overlay do not, so
both see these kinds as not decoded, exactly as before this branch.
IL2CPP finds unknown bytes by looking one pointer back from a read, so
a wider write of unknown value was read as stored zeros.
The section fallback takes a COPY record's span from the symbol its
table links to instead of assuming one word. A table counts as not
fully read when that size is not established, or when a record of
unknown extent writes memory that has no file bytes.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YT2WLf5G9AnLKF3bZtNLwf
* refactor(native): size section COPY records in one helper
Move the symbol lookup, the allowance and the unread-table note out of
the record loop, so the loop only asks for the extent a record is known
to write. Behavior is unchanged.
Cover the allowance across two section records, and keep the new test
code within the lint thresholds the base already meets.
Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YT2WLf5G9AnLKF3bZtNLwf
---------
Co-authored-by: thunderq10 <195775442+thunderq10@users.noreply.github.com>
Co-authored-by: Claude Fable 5.2 <noreply@anthropic.com>
* fix(elf): keep compressed storage out of decoded metadata facts
* fix(elf): preserve virtual relocation identity
Keep linked initializer backing and relocation values in their owning virtual
or ET_REL section coordinates. Replace the IL2CPP physical-copy materializer
with compact virtual value facts while preserving file-backed capacity.
Reuse initializer repairs and original regressions from ShuaixinHuang PRs
repair retains independent alias values instead of blanket alias refusal.
Co-authored-by: 帅鑫 Huang <1836656514@qq.com>
* fix(elf): admit compressed string tables the profile does not read
SHF_COMPRESSED string tables are rejected only when they name sections
or symbols. An unreferenced string table is not decoded, so it no longer
makes an otherwise analyzable ELF unsupported.
* fix(il2cpp): admit virtual pointer workspace before retention
* fix(elf): reject null relocation target sections
* fix(il2cpp): avoid decoding unrelated Mach-O words
* fix(il2cpp): preserve uncertainty in candidate scans
* fix(il2cpp): bound uncertain array candidates
* fix(il2cpp): preserve unknown registration candidates
* fix(il2cpp): classify type kinds before bound data
* fix(il2cpp): bind candidate counts to matching names
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: 帅鑫 Huang <1836656514@qq.com>
* fix(elf): keep compressed storage out of decoded metadata facts
* fix(elf): admit compressed string tables the profile does not read
SHF_COMPRESSED string tables are rejected only when they name sections
or symbols. An unreferenced string table is not decoded, so it no longer
makes an otherwise analyzable ELF unsupported.
* fix(elf): keep requirement names when verdef declares no entries
A compressed GNU version-definition section with sh_info 0 has no
definitions to decode. Skipping it leaves requirement names in place
instead of clearing them as an unread compressed table.
* fix(elf): skip empty version requirements before storage reads
* fix(elf): skip empty compressed version-requirement tables
A GNU verneed section with sh_info 0 has no requirement records. Reading
its compressed bytes was a version failure and partial coverage; the
declared count now skips that read.
* fix(mips): distinguish compressed metadata storage (#9959)
* fix(elf): note a missing symbol table only when a relocation needs it
A sectionless image with direct DT_INIT and DT_FINI no longer becomes incomplete solely because DT_SYMTAB does not match a decoded table. The same note remains when a dynamic relocation asks for a symbol.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* feat(native): list ELF and Mach-O initializer and finalizer functions
inspect_native_initializers and inspect-native-initializers list the
functions an ELF or Mach-O image runs before and after main: ELF
DT_INIT, DT_FINI, preinit, init and fini arrays and .ctors/.dtors, and
Mach-O __mod_init_func, __mod_term_func and __init_offsets, with slot
addresses, resolved targets, symbols where available and relocation
facts for relocatable objects. Nothing is executed. Slot, symbol,
relocation and note budgets are shared across tables, sentinels are
matched at the image width, and target-derived names are bounded and
marked untrusted.
* fix(native): keep ELF initializer slots unresolved when relocation coverage is partial
A skipped, unreadable or over-budget section relocation table now keeps
every slot it could reach unresolved instead of reading the stored word as
raw or dropping a .ctors slot as a sentinel. Dynamic writes that only
partly overlap a slot, or write it twice, leave it unresolved. Linked
images no longer reapply retained non-SHF_ALLOC link-time records.
The dynamic relocation walk now pauses at the shared reader's step
boundaries and observes cancellation there, resolved targets need only
their first byte mapped, and unreadable symbol names make the report
incomplete.
* fix(native): stop reporting unchecked Mach-O initializer words as resolved
Object files now apply their own section relocations: an UNSIGNED entry
against a defined symbol gives symbol_addend, one against an undefined
symbol gives unresolved_import, and any other entry leaves the slot
unresolved. Linked images without a fixup decoder, such as 32-bit ones,
keep pointer slots unresolved when an LC_DYLD_INFO bind stream or
LC_DYSYMTAB external relocations could replace the stored word.
LC_DYLD_INFO rebases now report dyld_info_rebase instead of
chained_fixup, and unreadable symbol names make the report incomplete.
Section headers keep their declared reloff and nreloc for this.
* docs(native): move initializer guide under docs/guides/native
The documentation guide assigns analyst workflows to docs/guides/<domain>/.
Move the guide there, place its navigation and directory entries in the
Native binaries group, and update links from the docs index, CLI guide,
spec and authored skill. The public /native-initializers route is
unchanged.
The guide and spec also describe per-slot relocation coverage, retained
link-time records, Mach-O object relocations, undecoded bind streams,
the dyld_info_rebase resolution and unreadable names.
* fix(native): keep IFUNC and partly relocated ELF initializer slots unresolved
An absolute relocation against an STT_GNU_IFUNC symbol no longer reports
the resolver address as the target. Section relocation records now use
their real write width, so a record that writes only part of a slot,
starts inside it or repeats it leaves the slot unresolved instead of
reading a raw zero or dropping a .ctors slot as a sentinel.
On 32-bit ARM the Thumb bit is cleared when locating a target's section
and file offset, while value_va keeps the stored callable value.
* fix(native): locate Thumb Mach-O initializer targets and reject arm64_32 with a 64-bit header
On CPU_TYPE_ARM the Thumb bit is cleared when locating and naming a
target, since nlist values do not carry it. An arm64_32 image that
declares a 64-bit header is rejected as malformed rather than read with
8-byte slots. The guide and spec describe IFUNC relocations, partly
relocated section slots, Thumb targets and this rejection.
* fix(native): index initializer address lookups and keep ambiguous mappings unknown
ELF and Mach-O initializer lookups now build the shared file mapping
index once per image, so each slot and target lookup is logarithmic in
the number of load segments rather than a scan of every mapping.
An address that load segments map ambiguously no longer falls back to a
section header offset. Its file offset is reported as unknown and the
report is incomplete; only genuinely unmapped spans use the section
fallback.
* fix(native): report Mach-O bind names over the name budget
A bound import name longer than the 1024-byte name budget was dropped
without a trace, although it is the only identity of an unresolved
initializer target. It now counts toward the over-long name limitation
and makes the report incomplete.
* test(native): count mapping lookups instead of timing the load index regression
The load-mapping regression asserted a wall-clock bound, which is
sensitive to machine load. It now spies on the shared mapping module and
requires the same number of mapping scans and index builds for 8 and 64
slots, so a per-slot scan of every load segment fails deterministically
on a small fixture.
* fix(native): yield while decoding legacy rebase runs
* fix(native): preserve initializer mapping and coverage
* fix(native): index legacy fixup spans
* fix(native): preserve relocation uncertainty and bound bind lookup work
* fix(native): validate ELF slot mappings and yield section relocation scans
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
