mirror of
https://github.com/morluto/rea.git
synced 2026-10-29 19:05:45 +00:00
e049ef70f71aeb9965e9d75d4d4a84ea02eaee11
2028
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Xiangfang Chen
|
e049ef70f7 |
feat(setup): add WorkBuddy client support (#3041)
* feat(setup): add WorkBuddy client support Register rea in the global ~/.workbuddy/mcp.json through a new workbuddy entry in SUPPORTED_CLIENT_DEFINITIONS (json dialect, ~/.workbuddy marker, ~/.workbuddy/skills skill directory; WorkBuddy AI shares the file). Document the client, extend the unreleased-client note, and cover registration and uninstall with boundary tests. * docs(setup): record verified WorkBuddy tool calls Real-client verification completed: WorkBuddy loads the registration and real REA tool calls execute through the registered server. |
||
|
xpeng5278-webandxpeng5278-web
|
bbf0638e88 |
fix(javascript): report EventSource and sendBeacon URLs as network endpoints (#3044)
Co-authored-by: xpeng5278-web <330743750+xpeng5278-web@users.noreply.github.com> |
||
|
|
242e2b0001 |
fix(ghidra): preserve function facet and call coverage (#3002)
* fix(ghidra): preserve observed function facet and call coverage Declare successful query availability in the Java producer, including explicit unavailable pseudocode reasons. Carry observed static call-set coverage through the parsed provider result and Evidence without inventing facts for legacy omissions. Use Ghidra indexed comment addresses over the function body and entry, retaining cancellation checks and sparse collection. Closes #2951 Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): retain unresolved call coverage in observations Share decoded unresolved-call facts between dossiers, callee coverage and reference observations. Combine terminal and unresolved observations in one instruction traversal and retain site records only when requested. Keep missing procedure identities incomplete and validate unresolved locations at the provider boundary. Bind snapshots to the corrected call coverage profile so older complete claims cannot replay under the new semantics. Add real public MCP callback trace/comparison regressions. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): separate reference targets from callee coverage Reuse containing-function ownership for resolved reference identities and independently compare those identities with the actual returned callee set. Keep known interior routes out of unresolved site records while retaining partial inventory coverage. Advance the coverage profile to v3 and reject interim v2 cache bindings. Add a real Ghidra producer regression with restored reference metadata; the previous bridge fails the known-route assertion. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): measure incoming call coverage across function bodies Compare incoming reference source identities across the owned function body and entry with the actual returned caller set. Stream caller-only checks and reuse dossier reference observations. Combine caller/callee coverage from observed counts without reinterpreting serialized metadata, and share the body scope owner with comments and references. Bind snapshots to function-body coverage semantics v4 and preserve the real off-entry caller regression. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(ghidra): preserve whole-scope directional call coverage Check body-and-entry call references independently of decoded instruction flow. Reuse collected dossier references and stream inventory-only coverage checks. Keep caller-only gaps distinct from incomplete outgoing coverage in offline path reconstruction, and invalidate prior snapshot profiles. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> * fix(mcp): retain compact Evidence field types Share optional diagnostics across the three tagged relationship coverage states instead of advertising duplicate branches. Preserve coverage validation while keeping compact Evidence properties within the existing reference expansion budget. Verify invalid direction cardinalities against the actual SDK-advertised schema. Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> --------- Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
Saim Shafiqueandmorluto
|
20e4f83097 |
fix(ghidra): fail doctor when the JVM os.arch selects an unvalidated decompiler directory (#2792)
* fix(ghidra): fail doctor when the JVM os.arch selects an unvalidated decompiler directory probeJava now also reads the JVM os.arch property. When it maps to a different native decompiler directory than the one validated from the host architecture (for example an x86_64 JDK under Rosetta on Apple silicon selecting os/mac_x86_64 while only mac_arm_64 was built), the native_decompiler check fails with a remediation pointing at a matching-arch JDK instead of reporting a healthy installation that fails every analysis. Unknown os.arch values keep the previous behavior. * fix(ghidra): tighten JVM arch remediation and cover os.arch extraction Address review findings on the JVM os.arch decompiler-directory check: - The remediation no longer suggests building the decompiler for the JVM-selected directory, which could never clear the check; it only advises pointing JAVA_HOME at a matching-architecture JDK. - Add a test running the real Java probe against captured -XshowSettings:properties output, asserting os.arch reaches the installation diagnostics. - Document the JDK-architecture prerequisite in the Ghidra setup guide. * fix(ghidra): refuse unrecognized JVM native architectures * docs(ghidra): align doctor prerequisites with JVM architecture admission * fix(ghidra): reject unreported JVM architecture * test(ghidra): separate JVM and executable admission cases * fix(ghidra): defer decompiler arch validation when Java is absent * fix(ghidra): reject JVM native architecture override * fix(ghidra): validate JVM platform overrides * fix(ghidra): validate JVM os.name and helper-environment platform overrides * test(ci): isolate report fixtures and declare PowerPC Java bounds * test(ghidra): provide observed JVM platform in PowerPC fixture * fix(ghidra): parse quoted JVM environment options before admission --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
97aff28201 |
fix(electron): reject non-executable paths and contain launch rejections (#2705)
* fix(electron): reject non-executable paths and contain launch rejections An executable_path that runs but never prints the inspector line made Playwright's electron.launch() leave three waits unawaited. They rejected unhandled and Node ended the CLI or the MCP server (#2269). Check the resolved executable_path is a regular file, and on non-Windows hosts that it passes X_OK, before any launch. Wrap only the launch call in a scoped unhandledRejection listener that absorbs rejections whose stack is in playwright-core/lib and re-throws anything else. Tested on Linux with Node 22.23.1, 24.18.0 and 26.11.1. Refs #2269 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊 * fix(electron): absorb only this launch's orphaned rejections The listener around the launch dropped every rejection with a playwright-core stack, so an unrelated Playwright failure during the launch window would vanish. Hold those rejections instead. When the launch settles, drop only the ones whose message is part of the launch's own error (the orphans of a failed launch). Raise every other one again through the unhandledRejection path, so the process still fails. A launch that succeeds raises all of them. Rejections without a Playwright stack still fail at once. One setImmediate turn before the decision lets rejections queued by the settling tick arrive first. It is a single turn, not a timer. A shared set of absorbed errors stops overlapping launches from raising each other's orphans. The listener is removed on every path. Add child-process tests that drive the built provider through its launch seam, since Vitest's worker has its own unhandledRejection listener. 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊 * test(electron): distinguish launch success from capture ownership * test(electron): assert cleanup ownership failures around overlapping launches * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> * fix(android): make DEX descriptor pattern portable * fix(ci): isolate Linux Hopper process fixture inventory * fix(browser): avoid replaying observed launch rejections * style: format comparison and IDA sources * test(electron): allow cold macOS ownership setup * test(electron): allow cold macOS setup in the early-exit path test The test that runs an executable which exits at once builds the Swift ownership helper twice on macOS: in the CLI process, and again in the MCP server process on its first tool call that prepares. A cold Swift cache can spend up to 120 seconds on a build. The test had only the 30 second default. Give the test 180 seconds, as |
||
|
|
641a8395ee |
fix(cli): refuse a JavaScript integrity policy the binary analyze lane cannot honor (#2808)
* fix(cli): refuse an integrity policy the binary analyze lane cannot honor `analyze` declares --integrity-policy for its JavaScript lane and forwards it only there. On a binary target the flag was accepted and then dropped: inspect_artifact-style integrity handling does not exist on this path, and binary_overview is a strictObject with no input at all, so the request could never take effect and the run proceeded as if the caller had not asked. The same branch already refuses source_paths on a binary target with a typed AnalysisInputError, and the sibling `inspect` command refuses the flag outright, so the refusal is the established handling here. The policy option carries a default, so the check keys off a value that differs from the owner schema's own default rather than the flag's presence; otherwise every binary analyze would be refused. The default is read from the schema instead of being restated. Verified with 5 integrity policy CLI cases, check:fast and verify:test-discovery (1023 files) on macOS arm64, and by running the built CLI for the no-flag, explicit-default and record-and-continue cases. The regression case failed with the command reaching the binary lane before the change. * fix(cli): reject explicit default integrity policies for binaries * fix(cli): keep an omitted integrity policy absent on the binary lane `javascriptApplicationOptions.shape.integrityPolicy` fills an omission with its default, and `.optional()` keeps reporting that parsed value, so `options.integrityPolicy !== undefined` was true for every `analyze <target>` call: ordinary binary analysis was rejected before the target was even read. List `z.undefined()` first in a union so an omitted option stays absent while the owner still validates a supplied value, and reapply the owner's metadata so help and `--schema` keep describing the option. Validation: tests/boundary/cli/javascriptIntegrityPolicyCli.test.ts reports 1 failed | 5 passed without this change (the case "still routes a binary analyze target without an integrity policy" returned invalid_request for integrity_policy instead of reaching the target) and 6 passed with it; `npm run check:fast` passes on macOS 26.5.1 arm64 with Node.js 24.18.0. * fix(cli): omit integrity defaults from binary option schema * test(ci): isolate report fixtures and declare PowerPC Java bounds --------- Co-authored-by: 吴佳浩 <wujiahao@supremind.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
1ae9000587 |
fix(javascript): exclude TypeScript this annotations from runtime parameters (#2761)
* fix(javascript): exclude TypeScript this annotations from runtime parameters * test(javascript): assert exact typed argument bindings * test(apple): keep dyld slice regression portable * fix(process): report no remaining time after a provider deadline fires Node timers can fire while performance.now() is still a fraction of a millisecond short of the monotonic deadline. ProviderStartupDeadline then reported interruption "timeout" and an aborted signal while remainingMs() returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0 (Hopper and Ghidra startup) could run past an elapsed deadline, and the real-timer test "aborts a bounded wait when its real monotonic deadline expires" failed intermittently in CI (expected 1 to be 0). Once the deadline's own timer has classified a timeout, report zero remaining time. A deterministic regression test fires the timer with the monotonic clock 0.4 ms short of the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(ci): restore descriptor and fixture validation * test(ci): retain verification coverage within lint limits * fix(test): share admitted Ghidra profile installation fixtures * fix(ci): isolate timing report fixtures from workflow state --------- Co-authored-by: hhang <169027046+xu91102@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morluto
|
b1b0211c28 |
fix(native): preserve observed function dossier coverage
Declare observed Ghidra and Hopper facets, preserve unavailable pseudocode, and attach dossier call-set coverage. Version the analysis profiles to invalidate older snapshots and remove the retired include_assembly fixture branch. Add MCP comparison and snapshot-replay regressions plus real-provider checks for empty and unavailable facets. Fixes #2980. |
||
|
Shivekandmorluto
|
80592b82a6 |
fix(javascript): keep CommonJS percent bytes literal (#3001)
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
b9b3a9098b |
fix(gemini): compare consolidated allowlists through one normalizer (#2495)
* fix(gemini): compare consolidated allowlists through one normalizer geminiServerPolicyBlock consolidates allowlists by normalized intersection but tested the consolidated list against the raw server key. Because the intersection keeps the spelling of whichever policy came first, the same pair of policies blocked the server in one arrangement and allowed it in the other, and the excluded test had the mirror-image asymmetry. Normalize the comparison key once and use the same normalizer for the exclusion test, the intersection and the membership test. The messages keep the caller-facing server key, so lookup and display stay separate. Verified with 88 client profile, lifecycle and registration tests, check:fast and verify:test-discovery on macOS arm64. The regression test drives setup twice with the same policies in both arrangements; before the change one arrangement failed and the other passed. * test(gemini): cover normalized exclusions and padded allowlist entries The regression case added with the fix drove the allowlist intersection in both spellings but left the other two comparisons the change touches uncovered: the exclusion membership test and the trimming applied to padded names. Reverting either behaviour kept the suite green, so neither was pinned. Greptile raised exactly this on the PR. An exclusion is now exercised as " REA " against the selected server, and a padded allowlist entry is exercised as the only policy, so a padded entry has to permit the same server its exact spelling permits rather than fall to the membership test. Verified with `npm run test:focused -- tests/boundary/cli/clientProfiles.test.ts`: 14 passed with the change; reverting only ClientConfigurationDocument.ts to main fails both cases, the arrangement case with `rea+REA: expected 1 to be +0` and the new one on both the excluded and the padded-allowlist assertions. * fix(process): report no remaining time after a provider deadline fires Node timers can fire while performance.now() is still a fraction of a millisecond short of the monotonic deadline. ProviderStartupDeadline then reported interruption "timeout" and an aborted signal while remainingMs() returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0 (Hopper and Ghidra startup) could run past an elapsed deadline, and the real-timer test "aborts a bounded wait when its real monotonic deadline expires" failed intermittently in CI (expected 1 to be 0). Once the deadline's own timer has classified a timeout, report zero remaining time. A deterministic regression test fires the timer with the monotonic clock 0.4 ms short of the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: 吴佳浩 <wujiahao@supremind.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
Yann Roberto
|
1f122c02b7 | fix(javascript): exclude HTML URL suffixes from path admission (#2833) | ||
|
|
bcb60c179e |
fix(browser): read expression-free template literals as module specifiers (#2842)
Captured-bundle chunk edges and source-map original module edges only accepted quoted string literals as import()/require() specifiers. Bundlers such as rolldown emit plain constants as expression-free template literals (import(`./chunk.js`)), so statically known dependencies were dropped while completeness stayed complete. Read both sites through the shared exact-literal reader (stringValue); template literals with substitutions stay unrecognized. On OWASP Juice Shop v20.3.0 this recovers 8 lazy chunk edges (previously 0). Fixes #2841 Fixes #2599 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: morluto <17176810+morluto@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
c6166d4b56 |
fix(javascript): retain bridge conditions on IPC joins (#2747)
* fix(javascript): retain bridge conditions on IPC joins * fix(javascript): retain IPC condition ownership * style(javascript): format bridge path regression * fix(process): report no remaining time after a provider deadline fires Node timers can fire while performance.now() is still a fraction of a millisecond short of the monotonic deadline. ProviderStartupDeadline then reported interruption "timeout" and an aborted signal while remainingMs() returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0 (Hopper and Ghidra startup) could run past an elapsed deadline, and the real-timer test "aborts a bounded wait when its real monotonic deadline expires" failed intermittently in CI (expected 1 to be 0). Once the deadline's own timer has classified a timeout, report zero remaining time. A deterministic regression test fires the timer with the monotonic clock 0.4 ms short of the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(javascript): preserve Electron join condition coverage --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Codex <codex@users.noreply.github.com> |
||
|
|
3a4d49406a |
fix(javascript): preserve Electron runtime entrypoint paths (#2742)
* fix(javascript): preserve Electron runtime entrypoint paths * fix(javascript): resolve runtime entrypoints before modules * fix(javascript): preserve Electron runtime path semantics * fix(javascript): resolve Electron renderers exactly * fix(javascript): retain runtime package aliases * fix(javascript): retain missing renderer URL paths * fix(javascript): resolve Electron URL and utility entries correctly * fix(javascript): reject suffix-only worker URLs * fix(javascript): respect Electron URL and utility path semantics * fix(javascript): separate Node runtime entrypoints from source imports * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> (cherry picked from commit |
||
|
|
7072f87baf |
fix(artifacts): preserve Mach-O load-command string identity (#2110)
* fix(artifacts): preserve Mach-O load-command string identity
* fix(process): report no remaining time after a provider deadline fires
Node timers can fire while performance.now() is still a fraction of a
millisecond short of the monotonic deadline. ProviderStartupDeadline then
reported interruption "timeout" and an aborted signal while remainingMs()
returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0
(Hopper and Ghidra startup) could run past an elapsed deadline, and the
real-timer test "aborts a bounded wait when its real monotonic deadline
expires" failed intermittently in CI (expected 1 to be 0).
Once the deadline's own timer has classified a timeout, report zero
remaining time. A deterministic regression test fires the timer with the
monotonic clock 0.4 ms short of the deadline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit
|
||
|
Jeremy Levartovskyandmorluto
|
1ebbc3b371 |
fix(managed): pair members by declared identity before name-free remaps (#2116)
* fix(managed): pair members by declared identity before name-free remaps
The first matching round keyed methods on signature and normalized CIL,
and fields on signature, without the declared type or name. Identical
members of different types fell into one ambiguous group, so a file
compared with itself reported unknowns, and a lone match across types
was reported as an unchanged exact pair while the member's own
counterpart went unpaired.
Pair by declared type, name, and exact CIL/signature first, then by
declared type, name, and raw signature. The name-free CIL/signature,
field-signature, and structural rounds now run last, as remaps, and
skip a pair across declared identities while either member's own type
and name remain unpaired on the other side.
Nested types that share a bare name still share one declared identity,
so their identical members stay ambiguous in a self-comparison.
* fix(managed): keep members with kept identities out of remap rounds
The cross-identity check applied only to one-to-one groups. A member
whose own declared type and name were still unpaired on the other side
could fall into a larger remap group and be reported ambiguous, and a
blocked candidate could make an otherwise unique remap ambiguous.
A remap round now drops such members before grouping, along with
members whose declaring type is unresolved. Same-identity structural
pairs get their own round before the remaps. Each member's declared
identity is computed once.
Ambiguity limitations now name the evidence a group shares, which
stays true whether the round keyed on names or not.
* fix(managed): keep names in unresolved identities and hold ambiguous ones
A member of an unresolved declaring type had no declared identity, so
the declared-identity rounds keyed it by CIL or signature alone. Two
unresolved members with different names paired as an exact match, and
a file compared with itself reported unresolved members ambiguous.
The declared identity now always includes the name, with a null type
for an unresolved one. Remap rounds still leave such members out.
A remap round now also leaves out a member whose own identity sits in
an ambiguous group on the other side, not only one left one-sided.
The undecoded-counterpart check uses the same declared identity.
* fix(managed): keep remap groups with unresolved owners ambiguous
Remap rounds dropped members of an unresolved declaring type before
grouping. Such a member can be another member's own counterpart, so a
resolved member could remap to a copy in another type while its
unresolved counterpart was reported added.
Unresolved members now join remap grouping, and a group that contains
one stays ambiguous instead of pairing.
The undecoded-counterpart set reuses each member's computed identity.
* fix(managed): keep ownerless members out of declared rounds when shared
A member whose declaring type did not resolve has a declared identity
of a null type and its name. The declared rounds paired two such
same-named members even when the other side also held a resolved
member with the same CIL and signature, which could be the owner. The
old name-free first round reported that group as ambiguous.
An ownerless member now enters the declared rounds only when no other
member on either side shares its exact CIL/signature key, and never
the declared structural round. Otherwise it reaches the remap rounds,
which keep any group with an unresolved member ambiguous.
* fix(managed): keep competitors of an ownerless member out of the declared round
When an ownerless member shares its exact CIL/signature key with another
member on the same side, its owner may be that member. The resolved
members holding the key now stay out of the declared round too, so they
cannot pair and consume the candidate the ownerless member may own, and
the remap round keeps the whole group ambiguous as main does. A lone
ownerless member still pairs with its lone counterpart.
* test(managed): split the ownerless comparison tests under the function length limit
The ownerless describe block reached 181 lines, past oxlint's
max-lines-per-function limit of 150. Move the structural-competitor
case into its own block.
* fix(managed): contest signatures and remap only open candidates
* fix(managed): retain blocked raw-signature choices as unknown
* fix(managed): keep member names in signature contention
* fix(managed): scope residual signature contention by name once
ownerlessContested applies competitionIdentityKey itself, but
unresolvedSignatureAmbiguities passed it keys that were already
name-scoped, so the contested set never matched the groups and the
same-signature, different-body case reported additions and removals
instead of one unknown group. Pass the raw signature key.
* fix(managed): constrain matchObserved to declared members
matchObserved passes its items to matchByKeys, which needs Declared, so
its looser { declaring_type } bound failed typecheck (TS2344, TS2322).
* fix(managed): retain held ownership contention for residual matches
* fix(test): bind workspace fixture in Hopper launch cases
* fix(ci): prepare worker tests and preserve Hopper cleanup ordering
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
|
||
|
Ariel Fikru Avicennaandmorluto
|
c86b09a109 |
feat(ghidra): admit 32-bit big-endian PowerPC ELF (#1747)
* feat(ghidra): admit 32-bit big-endian PowerPC ELF Recognize EM_PPC as a provider-neutral `powerpc` family that keeps its ELF class, byte order, type and flags, and admit ELF32 big-endian ET_EXEC through a bounded Ghidra lane. ELF64, little-endian, relocatable/shared objects and EF_PPC_EMB are refused with a specific reason; Hopper and IDA do not gain PowerPC support, and Windows Ghidra P0 is unchanged. Ghidra's ELF loader selects PowerPC:BE:32:e500:default for a plain EM_PPC header, which misreads 750-family code. The lane binds PowerPC:BE:32:default/default in the profile (language_selection "admitted-lane-v1"), imports with it and checks the reported language. A language set through REA_GHIDRA_LANGUAGE_ID still replaces the lane default. Add a source-owned fixture, fixed-encoding probe, GNU readelf cross-check and the optional `verify:ghidra:ppc` real-provider lane, plus docs/ghidra-ppc.md. Refs #1741 * style(ghidra): format shared PowerPC profile integration * fix(ghidra): preserve caller-selected PowerPC languages --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morluto
|
7e9fb6f1bb | test(javascript): run native type bindings with compiled boundary prerequisites | ||
|
morluto
|
0161a593e5 | style(hopper): format startup diagnostic expectations | ||
|
morluto
|
4acda94b76 |
fix(hopper): recover provenance-verified Spotlight exits
Verify the native helper's sealed identifier and pinned Apple signing team in BridgeLauncher, then carry that provenance to HopperClient. Only a verified native helper's complete not-found exit confirms no document handoff, allowing runtime and target-lease cleanup and retry; wrappers retain unknown document state. Share publisher identity with setup through the domain contract. Correct fixture teardown ordering and parameterized MCP coverage. Validation: 54 focused tests passed across boundary, CLI, MCP acceptance, diagnostics and installer coverage (one Linux-only case skipped); check:fast passed. Real codesign verification accepted the installed official Hopper helper; Spotlight failures and bridge recovery used process fixtures. |
||
|
|
4d98123279 |
fix(hopper): recover from a Spotlight not-found launch (#2795)
* fix(hopper): recover from a Spotlight not-found launch Hopper's native launcher locates the application through a fixed Spotlight query before any Apple event. With indexing disabled it exits 3 with a not-found report, but REA treated the external document as unconfirmed, retained the runtime and failed every later open_binary until the server restarted. Recognize the complete report as a pre-handoff failure, confirm no document exists, and tell the caller to enable Spotlight indexing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(hopper): require empty stdout for native launch signatures * fix(hopper): retain ownership after unverified Spotlight reports --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
morluto
|
6510d0d57f |
perf(ci): start source feedback early and diagnose stalled runs (#3013)
* perf(ci): start source feedback early and diagnose stalled runs * fix(ci): verify workflow identities before main comparison limits * fix(ci): preserve diagnostics across passing checks and install failures * fix(ci): preserve ambiguous workflow run ordering * fix(ci): preserve failure-report candidate and request budgets * fix(ci): retain candidate errors while checking later main evidence * fix(ci): retain partial reports and require complete health scans * test(ci): prune stale fixtures and duplicated assumptions |
||
|
Jeremy Levartovskyandmorluto
|
aa6f74af04 |
fix(setup): configure a comment-only Hermes config.yaml (#2096)
* fix(setup): configure a comment-only Hermes config.yaml
comments, or only a `---` marker, also parses to a null YAML document.
Setup still rejected it as malformed ("expected record, received null")
and reported Hermes as invalid.
Treat a null Hermes document as holding no settings, as #1983 does for
an empty file. The serializer already edits a comment-only document in
place. A bare `---` document holds a null scalar that takes no keys, so
replace it with a map and keep the comments written after the marker.
* fix(setup): keep rejecting an explicit null Hermes root
Only a document with no root, or a bare --- marker whose null scalar has
no source text, holds no settings. An explicit null or ~ is a value, so
setup and uninstall reject it as before, the same as any other non-map
root.
* test(setup): split the Hermes empty-configuration tests under the function length limit
The Hermes YAML registration block reached 159 lines, past oxlint's
max-lines-per-function limit of 150. Move the empty-document cases and
the multiple-document rejection into their own block.
* fix(setup): type the Hermes edit document as a plain Document
parseDocument with options returns a Document.Parsed, whose contents
accept only parsed nodes, so assigning the new map for a bare --- root
failed typecheck (TS2322). Annotate the edited document as Document, as
the code did before it moved into HermesConfigurationYaml.ts.
* fix(ci): isolate Linux Hopper process fixture inventory
---------
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
|
||
|
morconsultoriadigital-afkandClaude Opus 5
|
1342eddd03 |
test(analysis-view): order the message-cutoff fixture lexicographically (#3018)
boundedViewMessages returns uniqueSorted output, so the 100-message fixture
came back in lexicographic order ("message 59", "message 6", "message 60")
while the assertion compared against generation order. Pad the index to a
fixed width so both orders coincide and the test checks what it means to:
that no count-based cutoff applies below the byte budget.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
||
|
|
06739aeaf2 |
fix(javascript): ignore erased TypeScript names in native-addon requests (#2766)
* fix(javascript): ignore erased TypeScript names in native-addon requests Skip import type / export type declarations and per-binding type specifiers when collecting .node addon members so only runtime value imports request native exports (fixes #2667). Co-authored-by: Cursor <cursoragent@cursor.com> * test(javascript): cover erased TypeScript re-export forms * test(javascript): allow Inspector observation events to arrive * test(inspector): emit events before enable responses --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
4aa51bfe19 |
fix(reverse): reconcile cleanup ownership and mutation diagnostics (#2799)
* feat(process): add owned debugger shutdown lifecycle * feat(reverse): add local inspection commands * feat(gdb): add persistent debugger integration * feat(cutter): add Cutter bridge integration * test(reverse): enforce complete integration coverage * fix(process): preserve debugger shutdown ownership * fix(reverse): retain evidence across interrupted commands * fix(gdb): honor captured provider environment * test(process): cover debugger shutdown retries * fix(reverse): retain evidence for interrupted providers * test(process): cover debugger shutdown retries * fix(reverse): retain evidence for interrupted providers * fix(server): snapshot provider environment at creation * fix(reverse): close review gaps with complete coverage * fix(reverse): address inspection review findings * fix(gdb): bound sessions and retain cleanup ownership * fix(ci): require reverse-tools quality lane * fix(process): unref inherited debugger output pipes * fix(reverse): address remaining PR 1960 findings * fix(gdb): address remaining PR 1961 findings * fix(reverse): account for unrestricted provider execution * fix(process): retain debugger ownership until safe shutdown * fix(process): preserve replacement debugger sessions * fix(reverse): preserve admission and output provenance * fix(process): retain exited debugger until output settles * fix(mcp): bound provider admission and debugger cleanup * fix(reverse): preserve failure provenance and classify E2BIG * fix(gdb): preserve startup cleanup and detach safety * fix(process): retain debugger ownership after detach failure * fix(reverse): preserve mutation and failure provenance * fix(gdb): address debugger review findings * fix(reverse): rebind sessions after external mutation * fix(process): cap debugger output after exit * fix(gdb): protect one-shot detach verification * feat(debugger): add reverse tool coverage gate * test(debugger): cover integrated failure paths * fix(gdb): bound and preserve session observations * fix(gdb): address review regressions * style: format merged integration files * fix(reverse): preserve session and output evidence * refactor(gdb): share repeated test and partial result setup * fix(gdb): invalidate TTY proof for Python aliases * fix(reverse): retain failure output byte counts * test(process): synchronize late debugger output * fix(gdb): invalidate TTY proof for wrapped commands * fix(gdb): recognize wit command abbreviation * test(reverse): wait for cancelled descendant readiness * test(reverse): bound descendant cancellation cleanup * style(reverse): format integration tests and adapters * style: format reverse engineering integration files * test(reverse): remove duplicate environment harness * test(gdb): share session startup assertions * fix(gdb): invalidate output proof for command abbreviations * test(reverse): share composition edge case scenarios * fix(ci): recognize verification and mutation tool entries * test(rizin): cover successful fake inferior detach * test(cli): align full output failure envelope * test(cli): isolate reverse command lifecycle service * test(process): share debugger output fixture setup * fix(binary): preserve high-bit Windows signature bytes * style(binary): format Windows signature parser * test(mcp): preserve call coverage in unchanged comparison * fix(ci): include reverse tools Vitest configs in lint cache * fix(mcp): preserve target content on delivery errors * ci: align duplication ceiling with expanded suite * test(reverse): allow signal admission mutants * fix(reverse): bound retained cleanup failures to process owners * fix(test): replace drifting mutation ranges with owned selectors * fix(reverse): admit persistent commands and retain cleanup ownership * fix(cutter): recover timed-out commands from exact receipts * fix(cutter): reject unsupported bridge request kinds * fix(ci): repair client format and shared verification fixtures * fix(native): preserve debugger cleanup ownership and bridge authentication * test(native): retain diagnostics without perfect coverage requirements * chore(licenses): refresh locked dependency inventory and notices * fix(test): exclude transient command locks from mutation sandboxes * fix(gdb): admit only platforms with safe detach verification * fix(cutter): retain bounded completion receipts until acknowledgement * fix(cutter): acknowledge commands rejected before UI dispatch * test(reverse): fail cancellation checks before fixture teardown * test(gdb): clean up the retained broken-stdin fixture owner * docs(test): clarify focused provider verification scope * fix(rizin): retain close cleanup failures * fix(gdb): wait for inferior stop and bound MI buffering * fix(cutter): retain failed receipt acknowledgements * fix(rizin): return retained session identity on rebind failure * fix(gdb): preserve startup cancellation and lossy status * fix(rizin): retain launch provenance and assemble frames once * fix(cutter): recover receipts across callers and bound discovery * docs: describe debugger evidence and bridge recovery * fix(process): keep cleanup incomplete while writers remain Stopping a debugger no longer reports success when inherited output streams stay open, so BinarySession cannot reopen a binary a child is still changing. Concurrent Cutter cleanup retries share one receipt acknowledgement instead of treating a consumed receipt as failure. * fix(debuggers): recover cleanup with captured process identities * fix(analysis): retire sessions after unrestricted commands * fix(cli): preserve completed evidence after cleanup recovery * fix(cutter): bound frame collection and coalesce cleanup * fix(windows): resolve selected provider paths absolutely * fix(gdb): report decoding loss in failed startup evidence * fix(rizin): scope decoding loss to collected command frames * test(mcp): cover snapshot retirement in reverse tools CI --------- Co-authored-by: Daniel Gonçalves Araujo <47118053+dandgabr@users.noreply.github.com> Co-authored-by: REA Maintainers <noreply@github.com> Co-authored-by: OpenAI Codex <codex@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> |
||
|
morluto
|
0bf01dfa59 |
perf(ci): share trusted caches and fail fast on PR test failures (#3007)
* fix(ci): restore inherited validation failures * perf(ci): share trusted caches and fail fast on PR test failures * fix(ci): bound static cache and hash vitest config for knip - Bound the rolling .turbo/cache snapshot with 7d/500MB eviction so each trusted main save cannot accumulate history toward the GitHub limit. - Hash vitest.config.ts in knip inputs so removing the CiTestSequencer import invalidates the cached passing check. - Cover both in cache-policy and task-hash regressions. |
||
|
Quentin Limoandme
|
9630c8ff46 |
fix(adb): remove false exclusivity from the push-file description (#2990)
push_adb_file claimed to be the only device-mutating ADB tool while install, uninstall, start-app, start-activity and stop-app are also device-mutating. Drop the exclusivity claim from the contract description and the push limitations, keeping the device-mutation fact. Fixes #2602. Co-authored-by: me <me@medz.org> |
||
|
Nianze Wu
|
dd36b4a8a0 | feat(analysis-view): report observed query parameter names (#2982) | ||
|
|
3cb9d61ec1 |
fix(artifacts): describe ZIP non-entry coverage accurately (#2059)
* fix(artifacts): describe ZIP non-entry coverage accurately * fix(process): report no remaining time after a provider deadline fires Node timers can fire while performance.now() is still a fraction of a millisecond short of the monotonic deadline. ProviderStartupDeadline then reported interruption "timeout" and an aborted signal while remainingMs() returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0 (Hopper and Ghidra startup) could run past an elapsed deadline, and the real-timer test "aborts a bounded wait when its real monotonic deadline expires" failed intermittently in CI (expected 1 to be 0). Once the deadline's own timer has classified a timeout, report zero remaining time. A deterministic regression test fires the timer with the monotonic clock 0.4 ms short of the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * style: format comparison and IDA sources --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
2320ac23ee |
test(process): preserve terminal deadline expiry regression (#2055)
* fix(cli): preserve import-map option descriptions * fix(process): report no remaining time after a provider deadline fires Node timers can fire while performance.now() is still a fraction of a millisecond short of the monotonic deadline. ProviderStartupDeadline then reported interruption "timeout" and an aborted signal while remainingMs() returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0 (Hopper and Ghidra startup) could run past an elapsed deadline, and the real-timer test "aborts a bounded wait when its real monotonic deadline expires" failed intermittently in CI (expected 1 to be 0). Once the deadline's own timer has classified a timeout, report zero remaining time. A deterministic regression test fires the timer with the monotonic clock 0.4 ms short of the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(process): keep terminal deadline expiry sticky --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> |
||
|
|
cddf31d55e |
fix(wasm): preserve original glue source locations (#2114)
* fix(wasm): preserve original glue source locations * fix(wasm): retain BOM-prefixed hashbang glue references * test(wasm): parse the artifact contract before reading glue evidence * test(wasm): give glue fixtures and assertions a single owner * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> (cherry picked from commit |
||
|
LouisChenandLouisChen
|
ed24604ee1 |
fix(javascript): preserve empty ESM import names in provenance (#2797)
Co-authored-by: LouisChen <3361008+chqcjq@users.noreply.github.com> |
||
|
|
20b802f165 |
fix(analysis-view): bound limitations and unknowns per view (#2794)
* fix(analysis-view): bound limitations and unknowns per view Views of a JavaScript application or binary layout copied every parent limitation into both limitations and unknowns, so a parent with tens of thousands of limitations produced views as large as the complete record and exceeded the MCP response budget even for a one-item page. Each view now carries at most 64 distinct messages per field plus one line naming the omitted count and the parent Evidence that retains the full list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * test(analysis-view): assert exact bounded message notices Source inspection and targeted formatting only. Tests, builds, lint, typechecks and provider workloads were not run at the user's explicit request. * fix(analysis-view): preserve coverage facts in bounded messages Reserve JavaScript completeness and unknown-count facts before bulk limitations. Direct omission recovery to the source parent without assuming session retention. Preserve exact threshold assertions and add unrun exhausted-page/item and unretained-inline MCP regressions. Source inspection and targeted formatting only; tests/checks/builds/provider workloads/CI reruns skipped by explicit user request. * fix(analysis-view): bound repeated message serialization bytes * fix(analysis-view): let byte budget bound messages * test(analysis-view): exercise byte-based message omissions --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> |
||
|
|
23dc8fbf83 |
fix(application): accept alternative document selection in binary_ove… (#2680)
* fix(application): accept alternative document selection in binary_overview (#2460) Update binary_overview capability negotiation so that either current_document or list_documents satisfies the document identity requirement, matching resolveAnalysisDocument runtime semantics. When a provider declares neither document capability, resolveAnalysisDocument reports AnalysisCapabilityUnavailableError for current_document rather than leaking the internal list_documents fallback. Preserve list_segments as an independently mandatory requirement. * fix(application): retain document fallback provider errors Return the fallback producer error unchanged, retaining operation identity, retry advice, diagnostics and cleanup instead of fabricating missing capabilities. Source inspection and git diff --check; tests/builds/typechecks/CI reruns skipped at explicit user request. * test(application): retain document fallback error expectations Composition and MCP controls now expect the original list_documents producer error and reason. Source inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally. * fix(ida): assert attached-mode routing failure --------- Co-authored-by: yashas1624 <yashas1624@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
gongfppandgongfpp
|
0c6c571a01 |
perf(javascript): reuse semantic member-mutation lookups (#2941)
The semantic member-mutation collector revisits the same nodes while it closes alias chains, and each visit re-derived results that cannot change within the phase: - resolveSemanticBindingState re-walked the scope chain for the same identifier node. Definition collection completes before this phase, and addBinding is reachable only from it, so a scope's bindings no longer change. - directInitializerPosition, directMutationPosition and referenceInitializerPosition are pure functions of a node and the analysis parent map, but were recomputed for every mutation and initializer. - markValue re-encoded the same capture tuple with JSON.stringify and built a fresh long key for every Set/Map lookup, so each lookup re-hashed the whole key. The capture key is now cached per binding, origin and owner, and the lifetime key is derived from it. On pdfjs-dist 5.3.93 wasm/openjpeg_nowasm_fallback.js (462316 bytes, sha256 53c228428a8861035a34738966af263fc9d4cee6df25a0ad942af947469a0bd9) the semantic phase takes 177.8 s instead of 272.9 s in-process, with a byte-identical semantic IR. With --max-heap-mb 3072 and the default heap the base revision exhausts the worker; with the default 300 s per-source deadline raised, the completed CLI run takes 240.6 s instead of 396.7 s and its output is identical apart from volatile identifiers. Refs #2498 Co-authored-by: gongfpp <22683417+gongfpp@users.noreply.github.com> |
||
|
Devulapalli Naga Sri Vaishnavi
|
a9195c3a98 | fix(managed): retain raw CIL changes in member comparison (#2912) | ||
|
Aaditya
|
64041e3072 |
fix(session): reject an unknown configured provider before unbound routing (#2976)
When every registered deep provider rejected a target, select() returned an intentionally unbound success for any concrete environment selector, including one that names no registered provider. A misconfigured REA_ANALYSIS_PROVIDER therefore opened the target unbound, and the later deep-operation diagnostic blamed target support instead of the unknown configuration. The same identifier requested explicitly already failed with unknown_provider. Take the unbound shortcut only for a registered environment preference. An unknown configured identifier now reaches concrete selection and fails with unknown_provider, matching the explicit request. Registered preferences and auto still leave artifact-only targets unbound. Fixes #2592 |
||
|
|
39f96d7188 |
fix(qlog): list a hidden stream's records without spreading call arguments (#2860)
* fix(qlog): list a hidden stream's records without spreading call arguments When an explicit declaration matched a stream's derived total, the decoder pushed every contribution ordinal with a spread call. A stream with more than ~125k STREAM frames exceeded the engine's argument limit, so a valid capture within the input budget failed with RangeError instead of listing the records as incomplete. Push the ordinals in a loop. * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> * fix(ci): isolate Linux Hopper process fixture inventory * fix(android): make DEX descriptor pattern portable --------- Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
xingzhou
|
02095cd74a |
fix(browser): report complete storage key inventory changes (#2861)
* fix(browser): report complete storage key inventory changes * fix(browser): preserve unavailable storage inventory coverage Reuse the key-coverage propagation and independent fingerprint mapping proposed by chAng-L19 in morluto/rea#2491. Propagate failed or malformed inventories into the canonical completeness ledger before comparing membership; preserve independently proven value changes. Add producer-to-comparison regressions and document recapture requirements. |
||
|
|
26525706fc |
feat(managed): decode ldstr user strings in member inspection (#2162)
* feat(managed): decode ldstr user strings in member inspection
inspect_managed_members reported every ldstr operand as a bare 0x70 token,
so an analyst could see that a method loads a literal but not which one.
Answering "where is this path or key used" required a second tool.
Read the optional #US stream and add a top-level user_strings inventory:
each distinct token loaded by an inspected method body, once, in token
order, with its #US file offset and decoded UTF-16 value. Instruction
anchors and normalized CIL digests keep their build-local tokens. A missing
#US stream or malformed item is reported against its token as partial
coverage. Evidence recorded before this field reads user_strings as null.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): collect user strings only from ldstr
A malformed ldtoken can carry a 0x70 token, which the operand decoder
classifies as a string operand. Only ldstr loads a literal, so collect
user strings by opcode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): admit user-string tokens and failures before collecting them
Charge each distinct ldstr token to the decode budget before adding it to
the collection set, and admit each #US failure before retaining it. A
missing #US stream is now one stream-level issue rather than one per
token.
Document why the #US terminal flag is not validated: Mono and Roslyn
assemblies disagree with ECMA-335 II.24.2.4 and the runtime ignores it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs(managed): describe missing #US reporting and the unvalidated flag byte
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(managed): cover #US items that run past the stream end
An odd length whose payload crosses the end of #US, and a two-byte
length prefix that starts on the last #US byte, are both rejected as
"User string leaves #US" beside a readable literal. The test fails if
that bounds check is removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): report reserved #US length prefixes as string failures
The compressed-length reader shared by #Blob and #US hard-coded
invalid-blob and "Metadata blob" for a reserved prefix, so a malformed
user string was published as a blob failure. The caller now names the
item it reads: #Blob keeps its code and message, and #US reports
invalid-string.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): append member inspection issues without argument spreading
inspectManagedMembersBytes gathered every producer's issues with
issues.push(...list), passing one argument per issue. A large malformed
input, such as hundreds of thousands of distinct bad ldstr operands or
MemberRef rows, overflows the stack with an untyped RangeError instead of
returning partial coverage. All six sites now use
appendManagedParseIssues, which appends one issue at a time.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): classify truncated #US and #Blob length prefixes by item
A two- or four-byte compressed-length prefix cut off by the end of the
artifact went through the generic range check and was reported as
invalid-row. The prefix reader now uses the item's own code for both
reserved and truncated prefixes: invalid-string for #US, invalid-blob for
#Blob. The unused generic range helper is removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(managed): retain user-string terminal flag conformance issues
* test(managed): write ECMA-335 #US terminal flags and cover flag issues
|
||
|
|
45a3509db3 |
fix(artifacts): compare inventories using declared coverage (#2214)
* fix(artifacts): preserve complete root inventory comparisons * fix(artifacts): declare inventory coverage before comparison * fix(artifacts): preserve traversal omissions and materialization limits * fix(artifacts): preserve coverage declarations and projection scope Remove the duplicate inventory-schema import. Compare original coverage declarations, including field omission, before adapting legacy pages. Require explicit scope for completeness and container-entry coverage for application projections. Source inspection and git diff --check only. Tests, builds and typechecks skipped by explicit user request. GitHub review writes paused globally. * fix(artifacts): require entry coverage for child changes * fix(artifacts): accept source-valid inventory limitations * style(artifacts): format mobile graph projection --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: OpenAI Codex <openai-codex@users.noreply.github.com> |
||
|
|
e4186af31b |
fix(process): expose Darwin swiftc compile deadline via env (#2240)
* fix(process): expose Darwin swiftc compile deadline via env Busy hosts can exceed the hard-coded 60s ownership-helper compile timeout. Honor REA_SWIFTC_COMPILE_TIMEOUT_MS like the other provider startup deadlines, keeping 60000 as the default. Fixes #2184 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(process): keep the Swift compile deadline with its runtime owner * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> (cherry picked from commit |
||
|
Jeremy Levartovskyandmorluto
|
42667fc1a0 |
fix(wasm): report WABT output past its budget as a resource constraint (#2117)
* fix(wasm): report WABT output past its budget as a resource constraint A module whose WAT exceeds the 32 MiB output budget failed as unreadable_output, advised `rea doctor`, and echoed the full 32 MiB truncated WAT prefix in details.captured_output. Map the owned-command output-limit outcome during inspection to AnalysisResourceConstraintError naming the budget, as the apktool and native macOS providers do, with a remediation that says the fixed budget will not change on retry. Captured output for an output-limit failure keeps only the first 4,096 characters of each stream, including on the cleanup-failure path. An oversized --version probe keeps its configuration-phase mapping. * fix(wasm): keep observed sizes and whole code points in output-limit excerpts Cut each stream's output-limit excerpt with boundedUtf8Text at 4,096 UTF-8 bytes, so an astral character at the cut no longer leaves a lone surrogate. Mark the output truncated when either excerpt was cut, and report each stream's observed byte count. Word the remediation as a fact about the fixed budget. A flood of diagnostics from any WABT tool reaches this path, so it no longer says the module is too large. Replace the 32 MiB end-to-end test with a launcher seam that raises a small output-limit failure. * fix(wasm): match sibling captured-output fields for WABT output limits Report retained byte counts in stdout_bytes and stderr_bytes, as apktool and the firmware command do, and record exit_code and signal. Mark the excerpt truncated outright, since the command raises output-limit only after retention was truncated. When cleanup also fails, record the output limit and its budget as the previous error instead of the generic command message. Document that the two streams share the budget, so the excerpt holds up to 4,096 of the bytes each stream retained. * docs(wasm): scope the output-budget error to inspection commands * docs(wasm): distinguish reported warm costs from unmeasured gaps * docs(wasm): clarify the scope of reported warm measurements --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
|
729ca2ab6a |
fix(ghidra): report unapplied PE CodeView PDB limitation (#2283)
* fix(ghidra): report unapplied PE CodeView PDB limitation (#2259) When Ghidra analyzes a PE target that references companion debug symbols in its CodeView (IMAGE_DEBUG_TYPE_CODEVIEW / RSDS or NB10) debug directory, Ghidra's headless analyzer cannot automatically locate or apply the companion PDB from isolated runtime directories without companion admission. Procedure names remain analysis-generated (FUN_<address>). Parse CodeView debug metadata (RSDS GUID/age and NB10 age) during PE target resolution, and report an Evidence limitation informing callers and agents that referenced debug symbols were not applied and procedure names are analysis-generated. Fixes #2259 * test(pe): group CodeView header coverage separately * fix(ghidra): avoid contradictory PDB limitations * fix(android): make DEX descriptor pattern portable * fix(ci): isolate Linux Hopper process fixture inventory * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> * style: format identity comparison and IDA runner --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Lucien <164857476+dakjdakd@users.noreply.github.com> |
||
|
|
4481f86188 |
fix(frida): drain admitted operations and honor queued cancellation (#2305)
* fix(frida): drain admitted operations and honor queued cancellation * fix(frida): settle cancelled loads before queued resume * test(frida): share lifecycle fixtures without duplicating assertions * fix(frida): preserve operation admission before session close * test(apple): bound cold archive fixture compilation * fix(frida): retain cancelled script creation evidence * test(release): scope preflight schema to selected jobs * fix(process): report no remaining time after a provider deadline fires Node timers can fire while performance.now() is still a fraction of a millisecond short of the monotonic deadline. ProviderStartupDeadline then reported interruption "timeout" and an aborted signal while remainingMs() returned ceil(0.x) = 1, so polling loops guarded by remainingMs() > 0 (Hopper and Ghidra startup) could run past an elapsed deadline, and the real-timer test "aborts a bounded wait when its real monotonic deadline expires" failed intermittently in CI (expected 1 to be 0). Once the deadline's own timer has classified a timeout, report zero remaining time. A deterministic regression test fires the timer with the monotonic clock 0.4 ms short of the deadline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(comparison): recheck historical calls-only changes (#2223) * fix(comparison): preserve incomplete function call evidence Keep missing, unknown, partial and unresolved call relationships unknown in function comparisons and reconstruction claims. Aggregate IDA caller and callee coverage without overwriting uncertainty. Validate with 144 focused tests, typecheck/lint, docs checks and test discovery. Real providers were not verified; the full headless IDA session suite requires unavailable Windows native controls. * fix(comparison): recheck historical calls-only changes --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> (cherry picked from commit |
||
|
Jose Camargoandmorluto
|
72d5bbc96d |
fix(process): keep provider deadlines independent of wall-clock changes (#2311)
* fix(process): keep provider deadlines independent of wall-clock changes * fix(process): retain monotonic targets after early timers Adapt the stronger timer/poll owner from @nosmile99 PR #2793 as integrated by |
||
|
Yunzhou Liandmorluto
|
97268f40ea |
fix(dotnet): name the truncated instruction when an operand leaves the method body (#2704)
* fix(dotnet): name the truncated instruction when an operand leaves the method body The extent guard ran after the operand read, so a truncated operand threw a raw Buffer RangeError that replaced the intended diagnostic with the runtime message and lost the instruction identity. Bound the operand extent before reading its value and carry the width beside each fixed reader so the two facts cannot drift. Fixes #2677 * test(dotnet): consolidate truncated operand coverage --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> |
||
|
Shenrui Ma
|
388b907c92 |
perf(javascript): defer ambiguity expansion in version comparisons (#2962)
perf(javascript): avoid quadratic temporary matching state Repeated source groups can allocate candidates that later identity matches discard. Retain the original ambiguous groups until all tiers finish, expand only unmatched survivors, and append to locally owned key buckets in place. Constraint: Preserve matching priority, full ambiguity, and public output. Directive: Do not re-match residual groups that become unique after later tiers. Tested: 59 relevant tests, npm run check, and test discovery on current main. Tested: CLI benchmarks and full-suite failure comparison on the recorded base. Not-tested: Full suite on the updated main; native Linux and Windows workflows. |
||
|
|
0e6eca4085 |
feat(native): read embedded cargo-auditable Rust dependency lists (#2456)
* feat(native): read embedded cargo-auditable Rust dependency lists * fix(native): trim PE section padding and compute dependency cycles iteratively * fix(native): ignore SHT_NOBITS sections and validate dependency edges linearly * fix(native): bound compiler path scanning and retained hashes * fix(rust): pass package arrays as named parameterized test cases * fix(rust): admit graph expansion and preserve resource units * fix(rust): reject malformed packages, false cycles, and hidden compiler paths Fail the first malformed cargo-auditable package before Zod collects an issue per field. Require cyclic dependency indices to match the cycles in package dependencies. Keep read-only ELF ranges when a section name does not fit the bounded name window, so a rustc path in that range is still reported. * fix(ci): repair integrated checks and Hopper test baseline * fix(go): verify Mach-O sections against segments --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com> |