morluto
6de105bc60
fix(kuna): validate output and retain exact cleanup ownership ( #9974 )
...
* fix(kuna): preserve output validity and cleanup ownership
* fix(kuna): preserve Unicode boundaries in diagnostic tails
2026-11-11 00:26:08 -05:00
morluto
7aaff2e4e4
fix(cli): retain Evidence receipts on format refusal ( #9943 )
2026-11-11 00:22:30 -05:00
morluto and Cursor Agent
6a2b690440
fix(environment): preserve capture evidence during state inference ( #9897 )
...
fix(environment): preserve evidence when inferring and serving state
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-11 00:14:27 -05:00
N0zoM1z0 and gensokyo-dev
a8cd7cadc0
fix(ntfs): align inventory limitations with decoded metadata
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
22a3ba263e
refactor(ntfs): select metadata details from the retained identity index
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
1a8a9b749a
perf(ntfs): make detailed MFT pages opt in for journal queries
...
Keep inventory counts inline and preserve explicit 1–32 record detail requests. The real 26-record Windows sample serialized 57,946 metadata bytes before detail selection.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
c51ac43f9c
fix(ntfs): retain valid entries before malformed attribute list tails
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
710c353bff
feat(ntfs): page MFT metadata alongside journal events
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
96086e9c1f
feat(ntfs): report bounded V4 extents and unknown history coverage
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
f8ed4d16a0
feat(ntfs): decode V3 journal identities without false MFT joins
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
699cb72c48
feat(ntfs): validate resident and nonresident attribute metadata
...
Keep attribute parsing at the verified record boundary and retain only the identity index for journal joins.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
N0zoM1z0 and gensokyo-dev
411804afbf
feat(ntfs): expose source file names and lossless metadata
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:13:09 +08:00
morluto and Cursor Agent
81c09773be
fix(hopper): scope recovery guidance to the caller lifetime ( #9905 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-11 00:09:05 -05:00
morluto
25d46f3a58
fix(captures): validate packet read scope before paging ( #9922 )
2026-11-11 00:06:36 -05:00
morluto
75871ebb8b
fix(hopper): finish cleanup after progress observer failures ( #9966 )
2026-11-11 00:05:55 -05:00
N0zoM1z0 and gensokyo-dev
ffac2e0c99
perf(ntfs): reuse validated acquisitions and MFT identity lookups
...
Retain one completed pair per resource scope, revalidate selected file state on every page, invalidate failures, and clear retained bytes at shutdown. Keep cold CLI process costs explicit.
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
fc9585a44f
feat(artifacts): expose verified file state for snapshot reuse
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
7771fb7123
fix(ntfs): describe the journal page row limit
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2847464189
perf(ntfs): decode journal pages at their requested offsets
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
58edc31638
fix(ntfs): leave unused MFT reference identities unresolved
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
114b57678f
test(ntfs): retain paired facts through journal cleanup retry
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
4a8b157a28
fix(ntfs): retain completed MFT facts after journal failure
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
f3629bae94
fix(ntfs): retain the MFT identity after format refusal
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
48ee3f02fd
fix(ntfs): consume the parsed record identity verdict
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
6e8cd0bc5e
test(ntfs): use valid protected acquisition records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
3c54f3ce4e
fix(ntfs): preserve acquisition access and I/O failures
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
01a7e2c3b7
feat(ntfs): expose the journal timeline through CLI and MCP
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2e34aa0433
feat(ntfs): seal paired journal acquisitions as Evidence
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
c0b3c18b8a
feat(ntfs): page correlated journal observations by source offset
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
afed309f0f
fix(ntfs): exclude invalid MFT extents from journal matching
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
a3ff69f5ba
feat(artifacts): report MFT file-name coverage
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
a44d457745
feat(ntfs): correlate USN entries by full MFT identity
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
2be301f894
feat(ntfs): decode USN journal version 2 records
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
N0zoM1z0 and gensokyo-dev
73bc95d23f
feat(ntfs): decode resident MFT file names after fixups
...
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com >
2026-11-11 13:03:32 +08:00
morluto
a18867e623
fix(mcp): retain artifact comparisons after terminal cancellation ( #9945 )
2026-11-11 00:03:21 -05:00
morluto
d3899717b2
fix(browser): compare resource inventories with directional coverage ( #9935 )
2026-11-11 00:03:03 -05:00
morluto
755d58d29a
fix(deno): preserve raw specifier BOM characters ( #9949 )
...
fix(artifacts): preserve Deno specifier BOM characters
2026-11-11 00:02:03 -05:00
morluto
b725586fbf
fix(artifacts): isolate cancelled PyInstaller parse attempts ( #9961 )
2026-11-10 23:59:13 -05:00
morluto
e2bdfcee75
fix(uninstall): stop purging after skill removal failure ( #9947 )
2026-11-10 23:58:52 -05:00
morluto
647ebc2645
fix(artifacts): preserve bundle cleanup lease ownership ( #9948 )
...
fix(artifacts): retain bundle resource cleanup ownership
2026-11-10 23:58:30 -05:00
morluto
5d0391b06e
fix(ghidra): retain failed temporary probe resources ( #9970 )
...
fix(ghidra): retain failed probe descriptor cleanup
2026-11-10 23:58:22 -05:00
morluto
3eae278da5
fix(frida): preserve unknown capture policy facts ( #9934 )
2026-11-10 23:56:32 -05:00
morluto and Cursor Agent
133a849b2e
fix(browser-scenario)!: preserve scenario evidence and coverage ( #9896 )
...
* fix(browser-scenario): page captured text on Unicode boundaries
* fix(browser-scenario): retain popup events when open metadata exceeds its budget
* fix(browser-scenario): redact saved secrets across wire encodings
* fix(browser-scenario)!: record parsed request actions in evidence
BREAKING CHANGE: New captures with request actions that save nothing include save: [] in the recorded parameters. Their scenario and Evidence digests can differ from older captures of the same scenario. Read retained captures with their original recorded digests and use the newly recorded digest for new captures.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 23:48:13 -05:00
morluto and Cursor Agent
a6e02657e6
fix(artifacts): preserve unknown relationship coverage ( #9904 )
...
* fix(artifacts): preserve unknown relationship coverage
* fix(artifacts): retain producer relationship availability
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:52:59 -05:00
morluto
72b07c58d4
fix(wasm): bind known WABT source provenance to its verified release ( #9927 )
2026-11-10 22:52:21 -05:00
morluto and Cursor Agent
4d711acffd
fix(settings): report Ghidra limits for the operations that use them ( #9903 )
...
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:54 -05:00
morluto and Cursor Agent
5821506eb2
fix(native): preserve Mach-O source and decode facts ( #9902 )
...
* fix(native): retain Mach-O file identity through completion
* fix(native): distinguish malformed Mach-O encryption facts
* fix(native): preserve Mach-O command and dylib coverage
* fix(native): preserve Apple dispatch fixup and declaration facts
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
2026-11-10 22:50:26 -05:00
morluto
3c736dfe11
fix(targets): reject ambiguous native image selections ( #9933 )
...
fix(targets): refuse ambiguous slice and file mappings
2026-11-10 22:50:13 -05:00
morluto
82abd9e6ca
fix(v8): validate complete payload scan coverage ( #9928 )
2026-11-10 22:49:40 -05:00
morluto
29b41a7d94
fix(coverage): validate boundary identifiers at request admission ( #9919 )
2026-11-10 22:49:26 -05:00
morluto